A denial-of-service vulnerability exists in graphql-core, a Python library for building GraphQL APIs. The parser's `max_tokens` limit did not count comment tokens, allowing an attacker to bypass this limit by padding a document with comments. This could lead to increased memory allocation, potentially causing a denial-of-service attack. The vulnerability was reported by an unknown source and is documented [truncated]
CVE-2026-75507: GraphQL-core Denial of Service via Quadratic Complexity. The vulnerability affects GraphQL-core's OverlappingFieldsCanBeMerged validation rule, which can be exploited with a small, highly compressible query, potentially causing significant CPU resource consumption and denial-of-service attacks. GraphQL-core users, administrators, and developers should assess exposure and prioritize updates [truncated]
