PyPI/graphql-core CVE-2026-75508: high 7.5
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
Action: Upgrade graphql-core to 3.2.12 or later.
pip install graphql-core==3.2.12pip install graphql-core==3.3.0rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.2.3 | 3.2.12 | - |
| 3.3.0a3 | 3.3.0rc1 | - |
Fixed versions
| 3.2.12 | 3.3.0rc1 |
Sources
- osv: GHSA-r77w-qph3-7vf8
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8
- https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76787c5a5bad875a
- https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d
- https://github.com/graphql-python/graphql-core
- https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12
- https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1
CVE-2026-75508 · published · modified · JSON