GHSA-r7cg-qjjm-xhqq: webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input

May 5, 2026

GraphQL\Language\Parser is a recursive descent parser with no recursion depth limit and no zend.max_allowed_stack_size interaction. Crafted nested queries trigger a SIGSEGV in the PHP runtime, killing the FPM/CLI worker process. Smallest crashing payload is approximately 74 KB.

References

github.com/advisories/GHSA-r7cg-qjjm-xhqq
github.com/webonyx/graphql-php/commit/7b7f2080ca5f7d5340a696fc5701b19a9222d2c2
github.com/webonyx/graphql-php/releases/tag/v15.32.3
github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq

Code Behaviors & Features

Detect and mitigate GHSA-r7cg-qjjm-xhqq with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →