CVE-2026-75507— GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
Quick assessment
Affected
graphql-python graphql-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GraphQL-core 是 GraphQL.js 参考实现的 Python 移植版本。在 3.0.0 至 3.2.12 以及 3.3.0rc1 版本中，specified_rules 中的 OverlappingFieldsCanBeMerged 规则在验证阶段会反复比较具有相同响应名称的字段，并递归地重新比较扁平化后的内联片段。此前的命名片段记忆化（memoization）机制未覆盖此路径，因此嵌套的重复内联片段可能导致在解析器（resolver）或基于抽象语法树（AST）的深度/复杂度控制执行之前，产生二次甚
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75507
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
Source: CVE Program / CVE List V5
Vulnerability Description
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| graphql-python | graphql-core | >= 3.0.0, < 3.2.12 | - |
|
II. Public POCs for CVE-2026-75507
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75507
请登录查看更多情报信息。
Other References for CVE-2026-75507 (5)
-
https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12 x_refsource_MISC
IV. Related Vulnerabilities
Same weakness: CWE-400
-
CVE-2026-108359
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → -
CVE-2026-114610
fpdf2: Exponential SVG '<use>' expansion causes CPU and memo -
CVE-2026-75508
GraphQL-core: Denial of service via comment tokens bypassing -
CVE-2026-114603
OpenTelemetry Python: Unbounded tracestate parsing in opente -
CVE-2026-76290
Denial of Service (DoS) through Unauthenticated Package Down
V. Comments for CVE-2026-75507
No comments yet