graphql-core: Denial of service via comment tokens bypassing max_tokens
Summary
graphql-core, a Python port of the GraphQL.js reference implementation, does not count comment tokens toward its max_tokens limit. An unauthenticated remote attacker can send a highly compressible, comment-padded GraphQL document that passes the token limit while the parser allocates and retains many Token objects. This can exhaust worker memory before AST-based depth or complexity controls run, causing a denial of service. Exploitation requires only that the application parses untrusted GraphQL input.
Affected
- graphql-core 3.2.3 up to but excluding 3.2.12
- graphql-core 3.3.0a3 up to but excluding 3.3.0rc1
Fixed in
- graphql-core 3.2.12
- graphql-core 3.3.0rc1
Workaround
Unknown. The vendor does not describe a workaround, and a low max_tokens value does not protect against this issue before the update.
- Our suggestion: limit request body size at the reverse proxy or WAF, rate-limit the GraphQL endpoint, and restrict or disable it for untrusted users if it is not needed.
Exploitation
- CISA SSVC lists exploitation as "poc" (proof of concept), automatable: yes, technical impact: partial.
- The advisory describes a reproduction. We did not test or reproduce the payload.
- We know of no exploitation in the wild and no CISA KEV listing.
Our recommendation
- Check dependency lockfiles and environments for graphql-core and upgrade to 3.2.12, 3.3.0rc1 or later.
- Prioritise internet-facing Python GraphQL APIs. Internal tools without untrusted input carry lower risk.
- Comments now count toward max_tokens, so comment-heavy documents may be rejected. Test and adjust the limit before rollout.
- Monitor memory usage and worker restarts of GraphQL services.
- The same 3.2.12 release also fixes CVE-2026-75507.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA-r77w-qph3-7vf8 Security Advisory github.com
- Release v3.2.12 github.com
- Release v3.3.0rc1 github.com
- Fix commit 437dea1 github.com
- Fix commit 80ef435 github.com
- OSV entry GHSA-r77w-qph3-7vf8 osv.dev
- GitLab advisory CVE-2026-75508 advisories.gitlab.com
- Ubuntu security tracker CVE-2026-75508 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 12:46.
Original description (NVD)
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
NVD references (6)
- https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76787c5a5bad875a
- https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d
- https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12
- https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.