Executive brief
A vulnerability in the graphql-php library, which is used to build GraphQL APIs in PHP, allows an attacker to crash or slow down a server. By sending a specially crafted request with thousands of repeated fields, an attacker can force the server to consume excessive CPU resources during the validation phase. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.
Technical details
The 'OverlappingFieldsCanBeMerged' validation rule in graphql-php contains an O(n²) algorithmic complexity vulnerability. Specifically, the 'collectConflictsWithin()' function performs pairwise comparisons of all fields sharing the same response name. An unauthenticated remote attacker can exploit this by submitting a GraphQL query containing thousands of identical repeated fields. Because the validation occurs before execution and is not mitigated by standard QueryDepth or QueryComplexity rules, it leads to CPU exhaustion and request timeouts. The issue is fixed in version 15.31.5 by deduplicating field signatures before comparison.
Affected products
- webonyx graphql-php <= 15.31.4
Timeline
- 2026-04-11: patched: Version 15.31.5 released
- 2026-04-14: disclosed: GitHub Advisory published
- 2026-04-17: advisory: NVD published CVE-2026-40476