Is CVE-2026-40476 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40476 being exploited in the wild.

How severe is CVE-2026-40476?

High severity, with a CVSS score of 7.5, published 17 April 2026.

Which products and versions are affected?

webonyx/graphql-php (Packagist) <= 15.31.4, ECOSYSTEM:introduced=0,fixed=15.31.5; Webonyx Graphql-Php <= 15.31.4.

Is there a fix for CVE-2026-40476?

Yes. webonyx/graphql-php (Packagist): upgrade to 15.31.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40476 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40476?

Check whether you run webonyx/graphql-php (Packagist) or Webonyx Graphql-Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40476: webonyx graphql-php denial of service via quadratic complexity

Q: Is there a fix for CVE-2026-40476?

Yes. webonyx/graphql-php (Packagist): upgrade to 15.31.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40476 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-40476?

Check whether you run webonyx/graphql-php (Packagist) or Webonyx Graphql-Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40476 · Severity: high · CVSS 7.5 · Published 2026-04-17

A vulnerability in the graphql-php library, which is used to build GraphQL APIs in PHP, allows an attacker to crash or slow down a server. By sending a specially crafted request with thousands of repeated fields, an attacker can force the server to consume excessive CPU resources during the validation phase. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.

Technologies: webonyx/graphql-php (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-40476 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40476 being exploited in the wild.
How severe is CVE-2026-40476?: High severity, with a CVSS score of 7.5, published 17 April 2026.
Which products and versions are affected?: webonyx/graphql-php (Packagist) <= 15.31.4, ECOSYSTEM:introduced=0,fixed=15.31.5; Webonyx Graphql-Php <= 15.31.4.
Is there a fix for CVE-2026-40476?: Yes. webonyx/graphql-php (Packagist): upgrade to 15.31.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40476 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40476?: Check whether you run webonyx/graphql-php (Packagist) or Webonyx Graphql-Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

webonyx/graphql-php (Packagist): upgrade to 15.31.5 or later
```
composer require webonyx/graphql-php:^15.31.5
```

Technical details

The 'OverlappingFieldsCanBeMerged' validation rule in graphql-php contains an O(n²) algorithmic complexity vulnerability. Specifically, the 'collectConflictsWithin()' function performs pairwise comparisons of all fields sharing the same response name. An unauthenticated remote attacker can exploit this by submitting a GraphQL query containing thousands of identical repeated fields. Because the validation occurs before execution and is not mitigated by standard QueryDepth or QueryComplexity rules, it leads to CPU exhaustion and request timeouts. The issue is fixed in version 15.31.5 by deduplicating field signatures before comparison.

Affected products

webonyx graphql-php <= 15.31.4

Identifiers

CVE-2026-40476
GHSA-68jq-c3rv-pcrr

Timeline

2026-04-11: patched: Version 15.31.5 released
2026-04-14: disclosed: GitHub Advisory published
2026-04-17: advisory: NVD published CVE-2026-40476

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.