HIGH 7.5 GitHub
CVE-2026-75507
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
### Summary
The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and
in the worst case `O(n²·m²)` — running time by a small, highly compressible query. A
single 364 KB document can occupy one CPU core for over five minutes during
*validation*, before any resolver runs. Because the rule is part of `specified_rules`
and therefore enabled by default, every GraphQL-core based server is affected at
default settings.
### Details
`OverlappingFieldsCanBeMerged` compares e
Affected Products
- pip/graphql-core >= 3.0.0, < 3.2.12
- pip/graphql-core >= 3.3.0a1, < 3.3.0rc1
References
- https://github.com/advisories/GHSA-vj8h-fx38-h3vc
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc
- https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef8
- https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae04
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-10-22 via GitHub. Affected: pip/graphql-core >= 3.0.0, < 3.2.12, pip/graphql-core >= 3.3.0a1, < 3.3.0rc1.
vulnfeed aggregates 17299 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.