CVE-2026-107376: CWE-674: Uncontrolled Recursion in webonyx graphql-php

The webonyx graphql-php library versions before 15.32.3 have an uncontrolled recursion vulnerability (CWE-674) in the GraphQL\Language\Parser class. Specifically, the methods parseSelectionSet, parseValueLiteral, and parseTypeReference perform recursive descent parsing without limiting recursion depth. An attacker can exploit this by submitting deeply nested selection sets, object or list values, or list types, causing the PHP process stack to overflow and crash the PHP process with a SIGSEGV. This occurs during pre-validation parsing, before any query validation or complexity checks, and cannot be handled by application-level exception mechanisms. The issue is resolved in version 15.32.3.

Exploitation of this vulnerability can cause denial of service by crashing PHP-FPM workers or long-running PHP processes such as those running under Swoole, RoadRunner, ReactPHP, or CLI. This disrupts service availability and requires process restarts. There is no impact on confidentiality or data integrity as per the provided data. The crash cannot be caught or mitigated by application-level exception handling.

Upgrade to webonyx graphql-php version 15.32.3 or later, where this uncontrolled recursion vulnerability is fixed. No other mitigation is indicated or required as the fix addresses the root cause.