CVE-2026-75507 graphql-python CVE debrief

Who should care

GraphQL-core users, administrators, and developers should assess exposure and prioritize updates to prevent potential denial-of-service attacks. This includes reviewing and updating security configurations, conducting regular security audits, and developing incident response plans. Affected GraphQL-core users should also consider implementing compensating controls to limit potential denial-of-service attacks.

Why it matters

CVE-2026-75507 is a denial-of-service vulnerability in GraphQL-core's OverlappingFieldsCanBeMerged validation rule, which can be exploited with a small query, potentially causing significant CPU resource consumption and denial-of-service attacks. GraphQL-core users, administrators, and developers should assess exposure and prioritize updates to prevent potential exploitation.

• Denial-of-service attacks via specially crafted queries
• Potential for significant CPU resource consumption
• Need for validation and updates to prevent exploitation

Technical summary

The OverlappingFieldsCanBeMerged validation rule in GraphQL-core can be driven into quadratic running time by a small query, potentially causing denial-of-service attacks. This is due to the rule's comparison of every pair of fields that share a response name and recursion into their sub-selections. The vulnerability affects GraphQL-core based servers at default settings, as the rule is part of specified_rules and enabled by default. Users should prioritize validating and updating to fixed versions to prevent potential denial-of-service attacks.

Defensive priority

GraphQL-core users should prioritize validating and updating to fixed versions to prevent potential denial-of-service attacks.

Recommended defensive actions

• Validate and update GraphQL-core to version 3.2.12 or later
• Implement compensating controls to limit potential denial-of-service attacks
• Monitor for and respond to potential exploitation attempts
• Review and update security configurations to prevent exploitation
• Conduct regular security audits to identify potential vulnerabilities
• Develop and implement incident response plans for potential denial-of-service attacks
• Verify and document the effectiveness of implemented mitigations

Evidence notes

The CVE record and source item detail a denial-of-service vulnerability in GraphQL-core's OverlappingFieldsCanBeMerged validation rule, which can be exploited with a small, highly compressible query. The vulnerability is caused by the rule's comparison of every pair of fields that share a response name and recursion into their sub-selections, leading to quadratic running time. The memoization added for CVE-2023-26144 is keyed by named fragment identity, so it does not cover this path: inline fragments are flattened into the parent A

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.