CVE-2026-107376 webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input
Remote attackers can crash PHP processes by submitting deeply nested GraphQL queries, causing stack overflow before validation occurs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107376?
CVE-2026-107376 is a high-severity denial of service vulnerability in webonyx graphql-php, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3.
Weakness: CWE-674
Which versions are affected by CVE-2026-107376?
2 open source packages ship an affected version, including webonyx/graphql-php.
| Package | Affected | Fixed in |
|---|---|---|
webonyx/graphql-php Packagist | All versions | 15.32.3 |
webonyx/graphql-php Packagist | All versions | 15.32.3 |
How do I fix CVE-2026-107376?
Upgrade webonyx/graphql-php to 15.32.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107376 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107376 exists.
Sources
Also known as GHSA-r7cg-qjjm-xhqq.