openSUSE 16 Security Update : python-graphql-core (openSUSE-SU-2026:22258-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22258-1 advisory. Changes in python-graphql-core: - CVE-2026-75507: Fix quadratic complexity in OverlappingFieldsCanBeMerged validation rule when comparing nested...

Security update for python-graphql-core (important)

openSUSE security update: security update for python-graphql-core ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22258-1 Rating: important References: bsc1287829 bsc1287830 Cross-References: CVE-2026-75507 CVE-2026-75508 Affected Products: openSUSE...

ROOT-APP-PYPI-CVE-2026-75507 CVE-2026-75507 in graphql-core - Patched by Root

Root has patched CVE-2026-75507 in the graphql-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-75508 CVE-2026-75508 in graphql-core - Patched by Root

Root has patched CVE-2026-75508 in the graphql-core package for Root:PyPI. Multiple fixed versions available...

OPENSUSE-SU-2026:22258-1 Security update for python-graphql-core

This update for python-graphql-core fixes the following issues: Changes in python-graphql-core: - CVE-2026-75507: Fix quadratic complexity in OverlappingFieldsCanBeMerged validation rule when comparing nested inline fragments. bsc1287830 - CVE-2026-75508: Count skipped comment tokens toward the...

OPENSUSE-SU-2026:12474-1 python313-graphql-core-3.3.1-1.1 on GA media

These are all security issues fixed in the python313-graphql-core-3.3.1-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

SUSE CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

ROOT-APP-PYPI-CVE-2026-119286 CVE-2026-119286 in graphql-core - Patched by Root

Root has patched CVE-2026-119286 in the graphql-core package for Root:PyPI. Multiple fixed versions available...

CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

GraphQL-core Has Denial Of Service Via Memory Leak In Aborted Validations

Summary When a validation was aborted because the document contained more errors than allowed by "maxerrors" 100 by default, "validate" raised a single module-level "ValidationAbortedError" instance. Python appends the frames of every "raise" to the existing "traceback" of an exception that is...

Linux Distros Unpatched Vulnerability : CVE-2026-119286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a...

acryl-datahub-dagster-plugin (>=0.0.0.dev0, <=1.8.0rc4), boulder-opal (6.1.0) +66 more potentially affected by CVE-2026-119286 via graphql-core (>=3.3.0a11, <=3.3.0)

graphql-core PYPI version =3.3.0a11, =0.0.0.dev0, =1.1.1, =0.2.0, =0.6.7rc0, =0.8.6rc1, =0.1.0, =0.5.0rc4, =0.1.0, =0.0.6, =0.0.1a11, =1.1.1, =0.0.1, =0.7.0rc0, =0.11.14 and more Source cves: CVE-2026-119286 Source advisory: GHSA-MPQX-Q82W-9X46...

GHSA-MPQX-Q82W-9X46 GraphQL-core has denial of service via memory leak in aborted validations

Summary When a validation was aborted because the document contained more errors than allowed by maxerrors 100 by default, validate raised a single module-level ValidationAbortedError instance. Python appends the frames of every raise to the existing traceback of an exception that is raised again...

acryl-datahub-dagster-plugin (>=0.0.0.dev0, <=1.8.0rc4), boulder-opal (6.1.0) +66 more potentially affected by CVE-2026-119286 via graphql-core (>=3.3.0a11, <=3.3.0)

graphql-core PYPI version =3.3.0a11, =0.0.0.dev0, =1.1.1, =0.2.0, =0.6.7rc0, =0.8.6rc1, =0.1.0, =0.5.0rc4, =0.1.0, =0.0.6, =0.0.1a11, =1.1.1, =0.0.1, =0.7.0rc0, =0.11.14 and more Source cves: CVE-2026-119286 Source advisory: SNYK:PYTHON-GRAPHQLCORE-22132200...

acryl-datahub-dagster-plugin (>=0.0.0.dev0, <=1.8.0rc4), boulder-opal (6.1.0) +66 more potentially affected by CVE-2026-119286 via graphql-core (>=3.3.0a11, <=3.3.0)

graphql-core PYPI version =3.3.0a11, =0.0.0.dev0, =1.1.1, =0.2.0, =0.6.7rc0, =0.8.6rc1, =0.1.0, =0.5.0rc4, =0.1.0, =0.0.6, =0.0.1a11, =1.1.1, =0.0.1, =0.7.0rc0, =0.11.14 and more Source cves: CVE-2026-119286 Source advisory: OSV:GHSA-MPQX-Q82W-9X46...

EUVD-2026-113404

GraphQL-core has denial of service via memory leak in aborted validations...

GraphQL-core has denial of service via memory leak in aborted validations

Summary When a validation was aborted because the document contained more errors than allowed by maxerrors 100 by default, validate raised a single module-level ValidationAbortedError instance. Python appends the frames of every raise to the existing traceback of an exception that is raised again...

Missing Release of Memory after Effective Lifetime

Overview graphql-core is a GraphQL implementation for Python, a port of GraphQL.js, the JavaScript reference implementation for GraphQL. Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the validate function in...

CVE-2026-119286

A flaw was found in graphql-core. When validating queries that exceed the maximum allowed error threshold, the library reuses an internal error object across multiple requests. This causes Python to retain historical request data in memory for the lifetime of the process. A remote, unauthenticate...