# CVE-2026-75507: GraphQL-core denial of service in OverlappingFieldsCanBeMerged validation

Source: https://junglewise.ai/threats/cve-2026-75507-graphql-core-denial-of-service-via-quadratic-complexity-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-75507 · Severity: high · CVSS 7.5 · Published 2026-10-22

GraphQL-core is a reference implementation of GraphQL used by GraphQL servers to parse and validate queries. The default validation rules contain a flaw that allows attackers to send a small, compressible query that causes the validation engine to consume extreme CPU resources—a single request can pin a server process for minutes. No authentication is required, and many servers are affected because validation is enabled by default.

Technologies: [graphql-core (PyPI)](https://junglewise.ai/threats/technologies/graphql-core). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-75507 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75507 being exploited in the wild.

**How severe is CVE-2026-75507?** High severity, with a CVSS score of 7.5, published 22 October 2026.

**Which products and versions are affected?** Graphql-Core below 3.2.12 and below 3.3.0rc1; graphql-core (PyPI) >= 3.0.0, < 3.2.12, ECOSYSTEM:introduced=3.0.0,fixed=3.2.12.

**Is there a fix for CVE-2026-75507?** Yes. graphql-core (PyPI): upgrade to 3.2.12 or later. Until then: If you cannot upgrade, reject oversized documents before validation by enforcing a decompressed request body-size limit. Note that the comparison budget in patched versions bounds this specific rule; a body-size limit remains worthwhile as defense-in-depth against overall request cost.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-22"}, {"kind": "patched", "at": "2026-10-22", "note": "Fixed in 3.2.12 and 3.3.0rc1"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75507 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75507?** Check whether you run Graphql-Core or graphql-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- graphql-core (PyPI): upgrade to 3.2.12 or later

  ```sh
  pip install "graphql-core>=3.2.12"
  ```


If you cannot upgrade, reject oversized documents before validation by enforcing a decompressed request body-size limit. Note that the comparison budget in patched versions bounds this specific rule; a body-size limit remains worthwhile as defense-in-depth against overall request cost.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-22"}, {"kind": "patched", "at": "2026-10-22", "note": "Fixed in 3.2.12 and 3.3.0rc1"}]

## Technical details

The OverlappingFieldsCanBeMerged validation rule performs pairwise comparisons of fields in O(n²·m²) time due to incomplete memoization: inline fragments are flattened before caching, causing repeated comparisons across nesting levels. The rule had no comparison budget or timeout, allowing a crafted query with deep inline fragment nesting and repeated field selections to trigger quadratic behavior during the validation phase, before any resolver runs. Fixed by enforcing a per-document comparison budget (MAX_FIELD_COMPARISONS, default 250,000).

## Affected products

- GraphQL graphql-core below 3.2.12 and below 3.3.0rc1

## Identifiers

- CVE-2026-75507
- GHSA-vj8h-fx38-h3vc

## Related threats

- [GraphQL-core memory leak in validation error handling](https://junglewise.ai/threats/cve-2026-119286-graphql-core-is-a-python-port-of-the-graphql-js-reference)
- [GraphQL-core denial of service via comment tokens in parser](https://junglewise.ai/threats/cve-2026-75508-graphql-core-denial-of-service-via-comment-tokens-bypassing-the)