Memory Exhaustion Issue in GraphQL-Core Python Library
CVE-2026-75508
7.5HIGH
What is CVE-2026-75508?
The GraphQL-Core library, a Python implementation of GraphQL.js, faces a memory exhaustion vulnerability due to how comments are parsed. The parser does not adequately limit memory allocation for comments, allowing an unauthenticated remote attacker to exploit the weakness by sending specially crafted GraphQL requests. This can lead to significant memory consumption, potentially exhausting worker memory before any depth or complexity controls are enforced. Users are encouraged to upgrade to the patched versions 3.2.12 or 3.3.0rc1 to mitigate this issue.
Affected Version(s)
graphql-core >= 3.2.3, < 3.2.12 < 3.2.3, 3.2.12
graphql-core >= 3.3.0a3, < 3.3.0rc1 < 3.3.0a3, 3.3.0rc1