Threats tagged 'brew-schemathesis-cve-2026-75507'

A denial of service vulnerability exists in GraphQL-core's OverlappingFieldsCanBeMerged validation rule, which can be exploited by a crafted query causing quadratic to worst-case O(n²·m²) validation time. This can exhaust CPU resources for minutes on a single core during validation, without requiring authentication or exposing data. The issue affects default settings of GraphQL-core based servers. The vulnerability is fixed in versions 3.2.12 and 3.3.0rc1 by enforcing a comparison budget that aborts validation on excessive complexity.