PyPI/graphql-core CVE-2026-75507: high 7.5
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
Action: Upgrade graphql-core to 3.2.12 or later.
pip install graphql-core==3.2.12pip install graphql-core==3.3.0rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.12 | - |
| 3.3.0a1 | 3.3.0rc1 | - |
Fixed versions
| 3.2.12 | 3.3.0rc1 |
Sources
- osv: GHSA-vj8h-fx38-h3vc
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc
- https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198
- https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7
- https://github.com/graphql-python/graphql-core
- https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12
- https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1
CVE-2026-75507 · published · modified · JSON