Threat database

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

A vulnerability in graphql-core, a Python GraphQL implementation, allows unauthenticated remote attackers to cause uncontrolled resource consumption. The parser's max_tokens limit does not properly account for comment tokens, which are retained in memory despite being skipped, enabling memory exhaustion before other controls activate. This issue affects versions from 3.2.3 up to but not including 3.2.12, and from 3.3.0a3 up to but not including 3.3.0rc1. The vulnerability has a high severity with a CVSS score of 7.5 and is fixed in versions 3.2.12 and 3.3.0rc1.