graphql-core: Denial of service in OverlappingFieldsCanBeMerged validation
Summary
graphql-core, a Python port of the GraphQL.js reference implementation, contains a flaw in the OverlappingFieldsCanBeMerged validation rule. Crafted, highly compressible GraphQL queries can drive validation into quadratic or worse CPU work before any resolver or depth or complexity control runs. An unauthenticated remote attacker can send a small query that pins a worker process and can saturate a multi-worker service. The rule is enabled by default, so GraphQL endpoints built on affected versions are exposed.
Affected
- graphql-core 3.0.0 up to but not including 3.2.12
- graphql-core 3.3.0a1 up to but not including 3.3.0rc1
Fixed in
- graphql-core 3.2.12
- graphql-core 3.3.0rc1
- For the 3.3 line, the research notes recommend 3.3.1 or later; this release was not verified directly.
Workaround
Unknown. No upstream workaround was found. Limiting request body size and rate-limiting the GraphQL endpoint at a reverse proxy, and restarting hung workers, reduce the impact but do not fix the validation cost.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No known exploitation in the wild was found.
- No public proof of concept was found; this is not a guarantee that none exists.
Our recommendation
- Identify all Python environments with graphql-core, including lockfiles and container images, since it is often a transitive dependency.
- Upgrade to 3.2.12 at minimum, or to 3.3.1 or later for the 3.3 line.
- Prioritise internet-facing GraphQL endpoints that do not require authentication.
- Check distribution packages for fixed builds, as their status is unconfirmed; do not assume they are patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vj8h-fx38-h3vc github.com
- Fix commit 150e598 github.com
- Fix commit 29c2753 github.com
- graphql-core release v3.2.12 github.com
- graphql-core release v3.3.0rc1 github.com
- OSV CVE-2026-75507 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 12:45.
Original description (NVD)
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
NVD references (5)
- https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198
- https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7
- https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12
- https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.