Threats tagged 'brew-moto-cve-2026-75508'

A denial of service vulnerability in GraphQL-core's parser allows comment tokens to bypass the max_tokens limit, leading to excessive memory allocation. The parser's max_tokens counter did not include comment tokens, enabling an attacker to craft documents with many comments that consume large amounts of memory without triggering the limit. This can cause memory exhaustion and potential worker process termination. The issue is fixed in versions 3.2.12 and 3.3.0rc1 by counting comment tokens towards the max_tokens limit.