The vulnerability in graphql-php (CVE-2026-40476) arises from an inefficient algorithmic complexity in the OverlappingFieldsCanBeMerged validation rule, which performs O(n²) pairwise comparisons of fields sharing the same response name. This inefficiency allows an attacker to craft a query with a large number of repeated identical fields, leading to excessive CPU consumption during the validation phase before query execution. This can degrade service performance or cause denial of service conditions. The issue affects versions below 15.31.5 and has been addressed in version 15.31.5.

Exploitation of this vulnerability can cause excessive CPU usage on servers running vulnerable versions of graphql-php, potentially leading to denial of service or degraded performance. There is no indication of privilege escalation, data leakage, or other impacts beyond resource exhaustion. Existing query depth and complexity controls do not mitigate this issue.

Upgrade graphql-php to version 15.31.5 or later, where this inefficiency has been fixed. Since the vendor advisory does not specify any temporary workarounds or alternative mitigations, applying the official fix is the recommended action. Patch status is not explicitly confirmed in the advisory, but the fix is indicated by the version increment.