GHSA-3h96-34p3-xm76 GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens
Attackers can bypass token limits in GraphQL-Ruby by using comments, potentially causing denial of service if max_query_string_tokens is configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3h96-34p3-xm76?
GHSA-3h96-34p3-xm76 is a denial of service vulnerability in graphql, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GraphQL-Ruby's max_query_string_tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached.
In patched versions, the Ruby lexer does count these tokens.
GraphQL-CParser is not affected by this problem.
max_query_string_tokens was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.
Which versions are affected by GHSA-3h96-34p3-xm76?
8 open source packages ship an affected version, including graphql.
| Package | Affected | Fixed in |
|---|---|---|
graphql RubyGems | From 2.3.1 | 2.3.23 |
graphql RubyGems | From 2.3.1 | 2.3.23 |
graphql RubyGems | From 2.4.0 | 2.4.18 |
graphql RubyGems | From 2.4.0 | 2.4.18 |
graphql RubyGems | From 2.5.0 | 2.5.26 |
graphql RubyGems | From 2.5.0 | 2.5.26 |
2 more packages
graphql RubyGems | From 2.6.0 | 2.6.1 |
graphql RubyGems | From 2.6.0 | 2.6.1 |
How do I fix GHSA-3h96-34p3-xm76?
Upgrade graphql to a fixed version for your release line: 2.3.23, 2.4.18, 2.5.26 or 2.6.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-3h96-34p3-xm76 being exploited?
There is no known exploitation of GHSA-3h96-34p3-xm76 in the wild and no public exploit code.