GHSA-r7cg-qjjm-xhqq: webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
GraphQL\Language\Parser is a recursive descent parser with no recursion depth limit and no zend.max_allowed_stack_size interaction. Crafted nested queries trigger a SIGSEGV in the PHP runtime, killing the FPM/CLI worker process. Smallest crashing payload is approximately 74 KB.
References
Code Behaviors & Features
Detect and mitigate GHSA-r7cg-qjjm-xhqq with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →