CVE-2026-75507 Details

A denial-of-service vulnerability has been identified in GraphQL-Core, a Python implementation of GraphQL. This issue affects versions 3.0.0 prior to 3.2.12 and 3.3.0rc1, and arises within the OverlappingFieldsCanBeMerged validation rule. The vulnerability allows an unauthenticated remote attacker to submit a small, highly compressible GraphQL query that exploits repeated inline fragments. This crafted query can cause the validation process to consume excessive CPU time—up to five minutes—before any resolvers are executed. As a result, a single request can monopolize a worker process, with the potential to overwhelm a multi-worker service. The vulnerability exists because the validation rule compares fields with shared response names and recursively examines their sub-selections, leading to quadratic complexity. The issue is exacerbated by the absence of a comparison budget, allowing the validation to run unchecked,

Users can upgrade to GraphQL-Core versions 3.2.12 or 3.3.0rc1, both of which include the necessary fix. After upgrading, it's recommended to apply a request body-size limit to the decompressed request body, as the vulnerability can be exploited with a small, highly compressible query. If immediate upgrading is not possible, consider rejecting oversized documents before they reach the validation stage.