CVE-2026-119286— GraphQL-core: Denial of service via memory leak in aborted validations

Quick assessment

Affected

graphql-python graphql-core

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GraphQL-core 是 GraphQL.js 参考实现的 Python 移植版本。在 3.3.0a3 至 3.3.1 版本区间内，当文档的验证错误数量超过限制时，函数会重复使用一个模块级别的异常对象。由于 Python 在每次抛出该异常时都会将新的调用帧追加到其追踪（traceback）中，导致该异常对象在整个进程生命周期内不断累积每个文档、验证上下文及错误集合的信息。未经身份验证的客户端可以反复提交包含超过 100 个验证错误的小型文档，从而在查询执行前引发无界的内存增长，最终耗尽工作进程内存，且此过

CVSS 7.5 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1499 · Endpoint Denial of Service T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GraphQL-core: Denial of service via memory leak in aborted validations

Source: CVE Program / CVE List V5

Vulnerability Description

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
graphql-python	graphql-core	>= 3.3.0a3, < 3.3.1	-

II. Public POCs for CVE-2026-119286

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119286

请登录查看更多情报信息。

Other References for CVE-2026-119286 (5)

https://github.com/graphql-python/graphql-core/pull/288 x_refsource_MISC
https://github.com/graphql-python/graphql-core/issues/287 x_refsource_MISC
https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1 x_refsource_MISC
https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46 x_refsource_CONFIRM
https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119286

IV. Related Vulnerabilities

Same product: graphql-core

Same vendor: graphql-python

Same weakness: CWE-400