CVE-2026-75507: GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
The OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and
in the worst case O(n²·m²) — running time by a small, highly compressible query. A
single 364 KB document can occupy one CPU core for over five minutes during
validation, before any resolver runs. Because the rule is part of specified_rules
and therefore enabled by default, every GraphQL-core based server is affected at
default settings.
References
- github.com/advisories/GHSA-vj8h-fx38-h3vc
- github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198
- github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7
- github.com/graphql-python/graphql-core/releases/tag/v3.2.12
- github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1
- github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc
- nvd.nist.gov/vuln/detail/CVE-2026-75507
Code Behaviors & Features
Detect and mitigate CVE-2026-75507 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →