webonyx graphql-php: Stack overflow via deeply nested GraphQL queries

Summary

graphql-php is a PHP implementation of the GraphQL specification. Its parser uses recursive descent without a depth limit, so deeply nested selection sets, object or list values, or list types can exhaust the PHP stack before validation runs. An unauthenticated remote attacker who can reach a GraphQL endpoint can crash PHP processes with a segmentation fault, which application exception handling cannot catch.

Affected

• webonyx/graphql-php versions before 15.32.3 (Packagist advisory range: up to and including 15.32.2)
• Applications and frameworks that depend on affected versions, for example Lighthouse, GraphQLBundle, WPGraphQL and Drupal GraphQL

Fixed in

• Upgrade to webonyx/graphql-php 15.32.3 or later
• The fix adds the parser option recursionLimit (default 256)

Workaround

• Unknown. No vendor-documented interim workaround was found.
• Possible application-level measure (not vendor-tested): limit request body size at the reverse proxy or WAF.

Exploitation

• No public proof of concept found in the reviewed sources. The CISA SSVC assessment lists exploitation as PoC and automatable: yes.
• No known active exploitation found; not confirmed in CISA KEV.

Our recommendation

• Inventory PHP projects and composer.lock files for webonyx/graphql-php, including indirect dependencies via CMS plugins and frameworks.
• Upgrade to 15.32.3 or later and check that the framework does not pin an older version.
• Confirm that the recursionLimit option has not been set to 0 on internet-facing endpoints.
• Monitor PHP-FPM worker crashes and restarts on GraphQL endpoints.
• Priority: medium to high for internet-facing GraphQL endpoints, low for internal-only or disabled GraphQL.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-r7cg-qjjm-xhqq github.com
• Fix commit 6c1d6009 github.com
• Fix commit 7b7f2080 github.com
• Release v15.32.3 github.com
• OSV GHSA-r7cg-qjjm-xhqq osv.dev
• graphql-php security documentation webonyx.github.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:51.