Is CVE-2026-75507 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75507 being exploited in the wild.

How severe is CVE-2026-75507?

High severity, with a CVSS score of 7.5, published 22 October 2026.

Which products and versions are affected?

Graphql-Core below 3.2.12 and below 3.3.0rc1; graphql-core (PyPI) >= 3.0.0, < 3.2.12, ECOSYSTEM:introduced=3.0.0,fixed=3.2.12.

How is CVE-2026-75507 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-75507?

Check whether you run Graphql-Core or graphql-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75507: GraphQL-core denial of service in OverlappingFieldsCanBeMerged validation

Q: Is there a fix for CVE-2026-75507?

Yes. graphql-core (PyPI): upgrade to 3.2.12 or later. Until then: If you cannot upgrade, reject oversized documents before validation by enforcing a decompressed request body-size limit. Note that the comparison budget in patched versions bounds this specific rule; a body-size limit remains worthwhile as defense-in-depth against overall request cost. [{"kind": "disclosed", "at": "2026-10-22"}, {"kind": "patched", "at": "2026-10-22", "note": "Fixed in 3.2.12 and 3.3.0rc1"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-75507 · Severity: high · CVSS 7.5 · Published 2026-10-22

GraphQL-core is a reference implementation of GraphQL used by GraphQL servers to parse and validate queries. The default validation rules contain a flaw that allows attackers to send a small, compressible query that causes the validation engine to consume extreme CPU resources—a single request can pin a server process for minutes. No authentication is required, and many servers are affected because validation is enabled by default.

Technologies: graphql-core (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-75507 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75507 being exploited in the wild.
How severe is CVE-2026-75507?: High severity, with a CVSS score of 7.5, published 22 October 2026.
Which products and versions are affected?: Graphql-Core below 3.2.12 and below 3.3.0rc1; graphql-core (PyPI) >= 3.0.0, < 3.2.12, ECOSYSTEM:introduced=3.0.0,fixed=3.2.12.
Is there a fix for CVE-2026-75507?: Yes. graphql-core (PyPI): upgrade to 3.2.12 or later. Until then: If you cannot upgrade, reject oversized documents before validation by enforcing a decompressed request body-size limit. Note that the comparison budget in patched versions bounds this specific rule; a body-size limit remains worthwhile as defense-in-depth against overall request cost.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-22"}, {"kind": "patched", "at": "2026-10-22", "note": "Fixed in 3.2.12 and 3.3.0rc1"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75507 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-75507?: Check whether you run Graphql-Core or graphql-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

graphql-core (PyPI): upgrade to 3.2.12 or later
```
pip install "graphql-core>=3.2.12"
```

If you cannot upgrade, reject oversized documents before validation by enforcing a decompressed request body-size limit. Note that the comparison budget in patched versions bounds this specific rule; a body-size limit remains worthwhile as defense-in-depth against overall request cost.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-22"}, {"kind": "patched", "at": "2026-10-22", "note": "Fixed in 3.2.12 and 3.3.0rc1"}]

Technical details

The OverlappingFieldsCanBeMerged validation rule performs pairwise comparisons of fields in O(n²·m²) time due to incomplete memoization: inline fragments are flattened before caching, causing repeated comparisons across nesting levels. The rule had no comparison budget or timeout, allowing a crafted query with deep inline fragment nesting and repeated field selections to trigger quadratic behavior during the validation phase, before any resolver runs. Fixed by enforcing a per-document comparison budget (MAX_FIELD_COMPARISONS, default 250,000).

Affected products

GraphQL graphql-core below 3.2.12 and below 3.3.0rc1

Identifiers

CVE-2026-75507
GHSA-vj8h-fx38-h3vc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.