CVE-2026-107376 in graphql-php
Summary
by MITRE • 10/08/2026
webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in webonyx/graphql-php prior to version 15.32.3 represents a critical denial of service risk stemming from the absence of recursion depth limits within the GraphQL language parser. As a PHP implementation of the GraphQL specification, this library is responsible for translating client-submitted queries into executable structures. The core technical flaw resides in three specific parsing functions: parseSelectionSet, which handles nested field selections; parseValueLiteral, which processes complex object and list values; and parseTypeReference, which interprets type definitions. In these methods, the parser employs recursive descent to traverse the query structure without imposing any maximum depth constraint. This design choice assumes that incoming queries will adhere to reasonable complexity limits or be validated by higher-level components before reaching this stage of processing.
The operational impact of this flaw is severe because it allows a remote attacker to craft maliciously nested GraphQL queries that trigger an infinite or excessively deep recursion loop during the pre-validation parsing phase. Since these recursive calls occur before query validation and complexity controls are applied, standard mitigation strategies such as depth limiting rules configured at the application level cannot intercept the attack vector. The immediate consequence is the exhaustion of the PHP process stack space. When the available memory for the call stack is depleted, the underlying operating system sends a SIGSEGV signal to terminate the offending process. This results in an uncatchable crash that terminates PHP-FPM workers or long-running processes managed by Swoole, RoadRunner, ReactPHP, or command-line interfaces. Because this error occurs at the interpreter level rather than within application code, it cannot be handled via standard exception handling mechanisms, leading to immediate service disruption for all users sharing those worker processes.
From a classification perspective, this vulnerability aligns with CWE-675, which describes operations on data of insufficiently bounded size, specifically manifesting as uncontrolled recursion depth that leads to resource exhaustion. In the context of the MITRE ATT&CK framework, this behavior is categorized under T1499: Endpoint Denial of Service, where an attacker leverages application logic flaws to consume system resources and render services unavailable. The attack does not require authentication or privilege escalation, making it a straightforward remote denial-of-service vector that can be automated by threat actors targeting public-facing GraphQL endpoints.
To mitigate this vulnerability, organizations must upgrade the webonyx/graphql-php library to version 15.32.3 or later, where recursion limits have been implemented within the parser functions mentioned above. For environments unable to patch immediately due to dependency constraints, defensive measures should include implementing strict query depth limiting at the application layer using GraphQL validation rules that reject queries exceeding a defined nesting level before they reach the parser. Additionally, deploying Web Application Firewalls with deep packet inspection capabilities for GraphQL traffic can help identify and block excessively nested structures based on structural patterns rather than semantic content. Monitoring server logs for frequent PHP-FPM worker restarts or SIGSEGV signals can also serve as an early detection mechanism for ongoing exploitation attempts of this flaw.