CVE-2026-75507: CWE-400: Uncontrolled Resource Consumption in graphql-python graphql-core

graphql-core, a Python port of GraphQL.js, contains an uncontrolled resource consumption vulnerability (CWE-400) in its validation phase. Specifically, the OverlappingFieldsCanBeMerged rule repeatedly compares fields sharing response names and recursively re-compares flattened inline fragments without proper memoization. This leads to quadratic or worse CPU complexity (O(n²·m²)) before any resolver or depth/complexity controls execute. An unauthenticated remote attacker can exploit this by submitting shallow, highly compressible queries that cause a worker process to become pinned and saturate a multi-worker service. The vulnerability affects versions >=3.0.0 <3.2.12 and >=3.3.0a1 <3.3.0rc1 and is resolved in 3.2.12 and 3.3.0rc1.

Exploitation results in high CPU usage causing denial of service by saturating worker processes. There is no impact on confidentiality or integrity, but availability is severely affected. The attack requires no authentication and can be performed remotely.

Upgrade graphql-core to version 3.2.12 or later, or to 3.3.0rc1 or later, where the issue is fixed. No other mitigation is indicated by the vendor advisory.