cyfenced.com →

[ CVE-2026-75508 · Published 22 Oct 2026 ]

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

CVSS 7.5 Fix available

[ Description ]Official description

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

[ Fixes ]Fixes and patches

  • graphql-core 3.2.12Fixed version · GitHub Advisories · pip package graphql-core: upgrade to 3.2.12 or later (affected >= 3.2.3, < 3.2.12)
  • graphql-core 3.3.0rc1Fixed version · GitHub Advisories · pip package graphql-core: upgrade to 3.3.0rc1 or later (affected >= 3.3.0a3, < 3.3.0rc1)

[ Packages ]Affected open-source packages

[ References ]References