CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in Parser.advancelexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and...

GHSA-R77W-QPH3-7VF8 GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

Summary The parser's maxtokens limit — the documented defence against oversized GraphQL documents — did not count comment tokens. A document padded with comments could therefore pass a maxtokens check of any size while still allocating one Token object per comment, all of which stay reachable for...

GHSA-VJ8H-FX38-H3VC GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

Summary The OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and in the worst case On²·m² — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Because th...

CVE-2026-75507 GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

CVE-2026-75507

The GraphQL-core Python library (versions 3.0.0 to 3.2.12 and 3.3.0rc1) is vulnerable to a Denial of Service (DoS) attack due to quadratic complexity in the OverlappingFieldsCanBeMerged validation rule. The issue arises because the rule repeatedly compares fields with shared response names and re...

EUVD-2026-108226

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

CVE-2026-75508 GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in Parser.advancelexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and...

CVE-2026-75508

The GraphQL-core Python library (versions 3.2.3 through 3.2.12 and 3.3.0rc1 ) is vulnerable to a Denial of Service via memory exhaustion. The root cause is that the max_tokens limit in Parser.advance_lexer only counts non-comment tokens, while Lexer.lookahead() still allocates and retains Token o...

EUVD-2026-108225

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in Parser.advancelexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and...