GHSA-r7cg-qjgm-xhqq: Unbounded recursion stack overflow in webonyx/graphql-php

Vulnerability Overview Vulnerability Name: Unbounded recursion in parser causes stack overflow on crafted nested input Vulnerability ID: GHSA-r7cg-qjgm-xhqq Vulnerability Type: Stack Overflow Severity: High (8.2 / 10) Affected Component: webonyx/graphql-php (Composer) Affected Versions: <= 15.32.2 Fixed Version: 15.32.3 Description is a recursive descent parser without a recursion depth limit or interaction with . Carefully crafted nested queries trigger a SIGSEGV in the PHP runtime, killing FPM/CLI worker processes. The minimal crashing payload is approximately 74 KB. Impact Process Termination: A single 74 KB POST request kills the entire PHP process handling it. In php-fpm, worker processes are killed and regenerated by the master process; in other per-request runtimes (such as Swoole, RoadRunner, ReactPHP), the entire daemon dies. Pre-validation Bypass: is called before validation. Field count limits, complexity analyzers, persisted query allowlists, and all custom validators run after parsing, meaning they cannot intercept the crash. No Error Catching: Catchable errors such as slow queries, memory limits, or parser errors cannot be caught by PHP's . SIGSEGV is delivered by the kernel when the C stack pointer crosses the guard page; the PHP runtime has no opportunity to raise a user-space exception. The process exits with status code 139, and the block is never entered. Small Payload: 74 KB is well below most common HTTP request size limits. Queries are also highly compressible: repeating the pattern 37,500 times compresses to a few hundred bytes, bypassing nginx , AWS ALB payload size limits, and WAF inspections. Ecosystem Impact: is used by Lighthouse (Laravel), Overblog/GraphQLBundle (Symfony), wp-graphql (WordPress), the Drupal GraphQL module, and most PHP GraphQL servers. These could all be affected if the frontend layer rejects uncompressed payloads before they reach the parser. Remediation Option 1 - Add Parser-Level Recursion Depth Counter (Recommended) Add and fields to . Increment at the entry of each recursive method and decrement upon return. Throw a if the configured limit is exceeded. A reasonable default value is 256, which is far higher than any reasonable legitimate query and approximately half of the normal crash threshold. Apply the same pattern to , , , , , , and . The thrown is a standard syntax error that can be caught by user code. Option 2 - Iterative Parsing for Deepest Call Chains Rewrite , , , and to use an explicit work stack instead of mutual recursion. This completely eliminates the call frame budget for these vectors but does not address , which is more difficult to convert. Option 3 - Recommend Adding a Token Limit Option currently has no option. Adding a parser option would provide defense in depth if recursion limits are misconfigured. The most robust fix is Option 1 with a non-zero default . POC Code Crash Thresholds Measured crash thresholds on v15.31.4, PHP 8.3.30, , Linux x86_64. The smallest reliable crashing payload is Vector C (Nested List Values), at approximately 74 KB. All four vectors crash before any field, complexity, or depth validation rules are applied.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-r7cg-qjgm-xhqq: Unbounded recursion stack overflow in webonyx/graphql-php

More from this source