CVE-2026-107376 webonyx CVE debrief

Who should care

Defenders responsible for PHP applications using the webonyx/graphql-php package, especially those with untrusted input or GraphQL APIs, should assess exposure and prioritize verification and remediation.

Why it matters

Defenders should prioritize verifying exposure in PHP applications using the webonyx/graphql-php package, especially those with untrusted input or GraphQL APIs, due to the potential for denial-of-service, data loss, and difficulty in detecting attacks.

• Potential denial-of-service due to process termination
• Possible data loss or corruption due to concurrent request dropping
• Difficulty in detecting and diagnosing attacks due to lack of error messages or log entries
• Need for verification of exposure and remediation due to limited information on affected versions and exploitation

Technical summary

The webonyx/graphql-php package has an unbounded recursion vulnerability in its parser, which causes a stack overflow on crafted nested input. This results in a SIGSEGV in the PHP runtime, killing the FPM/CLI worker process. The vulnerability affects PHP applications using the webonyx/graphql-php package, especially those with untrusted input or GraphQL APIs. The parser's recursive descent design lacks recursion depth tracking, allowing crafted queries to trigger a stack overflow. The vulnerability has a CVSS score of 8.2 and is classified as HIGH severity.

Defensive priority

Defenders should prioritize verifying exposure in PHP applications using the webonyx/graphql-php package, especially those with untrusted input or GraphQL APIs.

Recommended defensive actions

• Verify exposure in PHP applications using the webonyx/graphql-php package
• Update to version 15.32.3 or later
• Monitor for suspicious GraphQL queries
• Implement input validation and sanitization
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the unbounded recursion vulnerability in the webonyx/graphql-php package, which causes a stack overflow on crafted nested input. The smallest crashing payload is approximately 74 KB.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.