Threat Intelligence Database

A resource consumption vulnerability exists in graphql-python's graphql-core library versions from 3.0.0 up to but not including 3.2.12, and from 3.3.0a1 up to but not including 3.3.0rc1. The OverlappingFieldsCanBeMerged validation rule inefficiently re-compares certain fields and inline fragments, leading to quadratic or worse CPU usage. An unauthenticated attacker can exploit this by submitting crafted GraphQL queries that cause excessive CPU consumption, potentially saturating service workers. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

A vulnerability in graphql-core, a Python GraphQL implementation, allows unauthenticated remote attackers to cause uncontrolled resource consumption. The parser's max_tokens limit does not properly account for comment tokens, which are retained in memory despite being skipped, enabling memory exhaustion before other controls activate. This issue affects versions from 3.2.3 up to but not including 3.2.12, and from 3.3.0a3 up to but not including 3.3.0rc1. The vulnerability has a high severity with a CVSS score of 7.5 and is fixed in versions 3.2.12 and 3.3.0rc1.