graphql-python graphql-core up to 3.2.11 Validation OverlappingFieldsCanBeMerged denial of service

Summaryinfo

A vulnerability labeled as problematic has been found in graphql-python graphql-core up to 3.2.11. This issue affects the function OverlappingFieldsCanBeMerged of the component Validation. Such manipulation leads to denial of service. This vulnerability is referenced as CVE-2026-75507. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in graphql-python graphql-core up to 3.2.11. It has been rated as problematic. Affected by this issue is the function OverlappingFieldsCanBeMerged of the component Validation. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-1347. Impacted is availability. CVE summarizes:

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-75507 since 08/17/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 3.2.12 or 3.3.0rc1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• graphql-python

Name

• graphql-core

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7
• 3.2.8
• 3.2.9
• 3.2.10
• 3.2.11

Website

• Product: https://github.com/graphql-python/graphql-core/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion