graphql-core, a Python port of the GraphQL.js reference implementation, leaks memory when a GraphQL document produces more than 100 validation errors. Each aborted validation adds frames to a shared exception object, so documents and validation contexts stay in memory for the lifetime of the process. An unauthenticated attacker can repeatedly send a small query to exhaust worker memory before execution, causing a denial of service, without disclosing or modifying data.
graphql-python · graphql-core
graphql-core, a Python port of the GraphQL.js reference implementation, does not count comment tokens toward its max_tokens limit. An unauthenticated remote attacker can send a highly compressible, comment-padded GraphQL document that passes the token limit while the parser allocates and retains many Token objects. This can exhaust worker memory before AST-based depth or complexity controls run, causing a denial of service. Exploitation requires only that the application parses untrusted GraphQL input.
graphql-python · graphql-core
graphql-core, a Python port of the GraphQL.js reference implementation, contains a flaw in the OverlappingFieldsCanBeMerged validation rule. Crafted, highly compressible GraphQL queries can drive validation into quadratic or worse CPU work before any resolver or depth or complexity control runs. An unauthenticated remote attacker can send a small query that pins a worker process and can saturate a multi-worker service. The rule is enabled by default, so GraphQL endpoints built on affected versions are exposed.
graphql-python · graphql-core
