CVE-2026-75507 GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-75507?
CVE-2026-75507 is a high-severity vulnerability in graphql-python graphql-core, published on 22 Oct 2026.
Official description
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
Which versions are affected by CVE-2026-75507?
4 open source packages ship an affected version, including graphql-core.
| Package | Affected | Fixed in |
|---|---|---|
graphql-core PyPI | From 3.0.0 | 3.2.12 |
graphql-core PyPI | From 3.0.0 | 3.2.12 |
graphql-core PyPI | From 3.3.0a1 | 3.3.0rc1 |
graphql-core PyPI | From 3.3.0a1 | 3.3.0rc1 |
How do I fix CVE-2026-75507?
Upgrade graphql-core to a fixed version for your release line: 3.2.12 or 3.3.0rc1.
Is CVE-2026-75507 being exploited?
There is no known exploitation of CVE-2026-75507 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-75507, GHSA-vj8h-fx38-h3vc, ROOT-APP-PYPI-CVE-2026-75507, UBUNTU-CVE-2026-75507.