PHP Implementation Vulnerability in Webonyx GraphQL Product

CVE-2026-107376

What is CVE-2026-107376?

The webonyx graphql-php product exhibits a vulnerability where the GraphQL parser performs recursive descent without a defined recursion limit in specific parsing functions. This allows remote attackers to exploit the system by submitting deeply nested selection sets or complex object and list types. As a result, the PHP process stack becomes overwhelmed, leading to SIGSEGV errors that can crash PHP-FPM workers and other long-running processes. This issue arises during the pre-validation parsing stage, bypassing standard query validation and complexity controls in place. The vulnerability has been addressed in version 15.32.3.

References