Threats affecting pkg:brew/schemathesis

A denial of service vulnerability in GraphQL-core allows an attacker to bypass the parser's max_tokens limit by padding documents with comment tokens. These comment tokens were not counted against the max_tokens limit, enabling excessive memory allocation and potential exhaustion. The issue is fixed in GraphQL-core version 4.26.0.

A denial of service vulnerability exists in GraphQL-core's OverlappingFieldsCanBeMerged validation rule, which can be exploited by a crafted query causing quadratic to worst-case O(n²·m²) validation time. This can exhaust CPU resources for minutes on a single core during validation, without requiring authentication or exposing data. The issue affects default settings of GraphQL-core based servers. The vulnerability is fixed in versions 3.2.12 and 3.3.0rc1 by enforcing a comparison budget that aborts validation on excessive complexity.

pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.