CVE-2026-40476

graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

CVSS 6.9 MEDIUMEPSS 0.5%CWE-407

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.9EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

17 Apr 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected products

webonyx · graphql-php

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/webonyx/graphql-php/releases/tag/v15.31.5 https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr