gql (4.3.0b1) potentially affected by CVE-2026-75508 via graphql-core (3.3.0a11)

graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75508 Source advisory: GHSA-R77W-QPH3-7VF8...

2112-generator-graphql-api (0.0.1), aionto-sdk (>=0.1.0rc1, <=0.1.0rc3) +280 more potentially affected by CVE-2026-75508 via graphql-core (>=3.2.3, <=3.2.11)

graphql-core PYPI version =3.2.3, =0.1.0rc1, =1.0.83, =3.2.2, =0.2.0, =0.3.0, =0.5.0, =2.0.0, =1.0.9, =0.2.0, =0.25.0, =0.1.0rc1, =1.4.0rc1 - baseapp-django-channels-graphql-ws 1.0.0rc9 and more Source cves: CVE-2026-75508 Source advisory: SNYK:PYTHON-GRAPHQLCORE-21433569...

Allocation of Resources Without Limits or Throttling

Overview graphql-core is a GraphQL implementation for Python, a port of GraphQL.js, the JavaScript reference implementation for GraphQL. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the advancelexer function in...

gql (4.3.0b1) potentially affected by CVE-2026-75507 via graphql-core (3.3.0a11)

graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75507 Source advisory: OSV:GHSA-VJ8H-FX38-H3VC...

gql (4.3.0b1) potentially affected by CVE-2026-75507 via graphql-core (3.3.0a11)

graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75507 Source advisory: SNYK:PYTHON-GRAPHQLCORE-21433568...

2112-generator-graphql-api (0.0.1), aiomothr (>=0.1.0, <=0.1.3) +329 more potentially affected by CVE-2023-26144 +1 more via graphql-core (>=3.0.1, <=3.2.11)

graphql-core PYPI version =3.0.1, =0.1.0, =0.1.0rc1, =0.16.3, =1.0.83, =3.2.2, =0.2.0, =0.3.0, =0.5.0, =2.0.0, =1.0.9, =0.2.0, =5.9.10 and more Source cves: CVE-2023-26144, CVE-2026-75507 Source advisory: GHSA-VJ8H-FX38-H3VC...

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

Summary The OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and in the worst case On²·m² — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Because th...

2112-generator-graphql-api (0.0.1), aiomothr (>=0.1.0, <=0.1.3) +329 more potentially affected by CVE-2026-75507 via graphql-core (>=3.0.1, <=3.2.11)

graphql-core PYPI version =3.0.1, =0.1.0, =0.1.0rc1, =0.16.3, =1.0.83, =3.2.2, =0.2.0, =0.3.0, =0.5.0, =2.0.0, =1.0.9, =0.2.0, =5.9.10 and more Source cves: CVE-2026-75507 Source advisory: SNYK:PYTHON-GRAPHQLCORE-21433568...

2112-generator-graphql-api (0.0.1), aiomothr (>=0.1.0, <=0.1.3) +329 more potentially affected by CVE-2026-75507 via graphql-core (>=3.0.1, <=3.2.11)

graphql-core PYPI version =3.0.1, =0.1.0, =0.1.0rc1, =0.16.3, =1.0.83, =3.2.2, =0.2.0, =0.3.0, =0.5.0, =2.0.0, =1.0.9, =0.2.0, =5.9.10 and more Source cves: CVE-2026-75507 Source advisory: OSV:GHSA-VJ8H-FX38-H3VC...

Inefficient Algorithmic Complexity

Overview graphql-core is a GraphQL implementation for Python, a port of GraphQL.js, the JavaScript reference implementation for GraphQL. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the OverlappingFieldsCanBeMergedRule validation rule in...

GHSA-VJ8H-FX38-H3VC GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

Summary The OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and in the worst case On²·m² — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Because th...

gql (4.3.0b1) potentially affected by CVE-2023-26144 +1 more via graphql-core (3.3.0a11)

graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2023-26144, CVE-2026-75507 Source advisory: GHSA-VJ8H-FX38-H3VC...

CVE-2026-75507 GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

2112-generator-graphql-api (0.0.1), aiomothr (>=0.1.0, <=0.1.3) +339 more potentially affected by CVE-2026-75507 via graphql-core (>=3.0.0a2, <=3.2.11)

graphql-core PYPI version =3.0.0a2, =0.1.0, =0.1.0rc1, =0.16.3, =1.0.83, =3.2.2, =0.2.0, =0.3.0, =0.5.0, =2.0.0, =1.0.9, =0.2.0, =5.9.10 and more Source cves: CVE-2026-75507 Source advisory: MEND:CVE-2026-75507...

CVE-2026-75507

The GraphQL-core Python library (versions 3.0.0 to 3.2.12 and 3.3.0rc1) is vulnerable to a Denial of Service (DoS) attack due to quadratic complexity in the OverlappingFieldsCanBeMerged validation rule. The issue arises because the rule repeatedly compares fields with shared response names and re...

CVE-2026-75507 GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

CVE-2026-75507 GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

EUVD-2026-108226

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

acryl-datahub-dagster-plugin (>=0.0.0.dev0, <=1.8.0rc4), boulder-opal (6.1.0) +64 more potentially affected by CVE-2026-75507 via graphql-core (>=3.3.0a11, <=3.3.0rc1)

graphql-core PYPI version =3.3.0a11, =0.0.0.dev0, =1.1.1, =0.2.0, =0.6.7rc0, =0.8.6rc1, =0.1.0, =0.5.0rc4, =0.1.0, =0.0.6, =0.0.1a11, =1.1.1, =0.0.1, =0.7.0rc0, =0.11.14 and more Source cves: CVE-2026-75507 Source advisory: MEND:CVE-2026-75507...