CLSA-2026-1786616236 TuxCare security update for webonyx/graphql-php (4 CVEs)

TuxCare rebuilt webonyx/graphql-php to address 4 CVEs. Fixed in v14.11.10-p1+tuxcare...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through unbounded recursion in the Parser process. An attacker can cause process termination and denial of service by submitting a specially crafted, deeply nested input that exhausts the stack and triggers a...

Denial Of Service (DoS)

webonyx/graphql-php is vulnerable to denial of service DoS. The vulnerability is due to the OverlappingFieldsCanBeMerged validation rule performing On² pairwise comparisons on fields with the same response name, which allows an attacker to submit a GraphQL query containing thousands of repeated...

CVE-2026-40476 graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs On² pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU...