Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-75508— GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

Quick assessment

Affected
graphql-python graphql-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GraphQL-core 是 GraphQL.js 参考实现的 Python 移植版本。在 3.2.3 至 3.2.12 版本以及 3.3.0rc1 版本中，解析器的 限制在 方法中仅统计 跳过注释后返回的非注释 token。然而，每个被跳过的注释仍会被分配为一个 Token，并通过 和 指针保留在链表中。因此，攻击者可以构造一个经过高度压缩、填充大量注释的 GraphQL 文档，使其在通过较低的 token 数量限制检查的同时，消耗大量内存。未认证的远程攻击者可借此在基于抽象语法树（AST）的深度或复杂度控制措施

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
graphql-python graphql-core >= 3.2.3, < 3.2.12 affected
>= 3.3.0a3, < 3.3.0rc1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75508

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
Source: CVE Program / CVE List V5
Vulnerability Description
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
graphql-python graphql-core >= 3.2.3, < 3.2.12 -

II. Public POCs for CVE-2026-75508

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75508

请登录查看更多情报信息。

Other References for CVE-2026-75508 (5)

IV. Related Vulnerabilities

Same product: graphql-core
Same vendor: graphql-python
Same weakness: CWE-400

V. Comments for CVE-2026-75508

No comments yet

Leave a comment