{"action":"Upgrade graphql-core to 3.2.12 or later.","affected":[{"fixed":"3.2.12","introduced":"3.0.0"},{"fixed":"3.3.0rc1","introduced":"3.3.0a1"}],"component":"graphql-core","cve_ids":["CVE-2026-75507"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["3.2.12","3.3.0rc1"],"ghsa_id":"GHSA-vj8h-fx38-h3vc","id":"tcs_01M5JMD6R656SSKM33KQ2TXBRH","modified_at":"2026-10-22T16:45:03.746268085Z","published_at":"2026-10-22T16:26:40Z","references":["https://osv.dev/vulnerability/GHSA-vj8h-fx38-h3vc","https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc","https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198","https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7","https://github.com/graphql-python/graphql-core","https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12","https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-vj8h-fx38-h3vc","url":"https://osv.dev/vulnerability/GHSA-vj8h-fx38-h3vc"}],"summary":"GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule"}