The vulnerability in graphql-php (CVE-2026-40476) involves the OverlappingFieldsCanBeMerged validation rule performing quadratic time complexity (O(n²)) pairwise comparisons on fields sharing the same response name. This inefficient algorithmic behavior allows an attacker to craft GraphQL queries with thousands of repeated identical fields, leading to excessive CPU consumption during the validation phase. This can degrade service performance or cause denial of service conditions. The problem affects versions below 15.31.5 and is not mitigated by existing query complexity or depth limits. The issue has been addressed and fixed in version 15.31.5.

Exploitation of this vulnerability can cause excessive CPU usage on servers running vulnerable versions of graphql-php during query validation, potentially leading to denial of service or degraded performance. There is no indication of privilege escalation, data leakage, or other impacts beyond resource exhaustion. Existing query complexity and depth controls do not prevent this attack vector.

Upgrade graphql-php to version 15.31.5 or later, where this issue has been fixed. No other mitigations are indicated or effective against this specific vulnerability. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the description confirms the fix is included in version 15.31.5.