{"action":"Upgrade graphql-core to 3.2.12 or later.","affected":[{"fixed":"3.2.12","introduced":"3.2.3"},{"fixed":"3.3.0rc1","introduced":"3.3.0a3"}],"component":"graphql-core","cve_ids":["CVE-2026-75508"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["3.2.12","3.3.0rc1"],"ghsa_id":"GHSA-r77w-qph3-7vf8","id":"tcs_01M5JMD86VK7FXSP5BV6BZ782N","modified_at":"2026-10-22T16:45:04.297396287Z","published_at":"2026-10-22T16:27:14Z","references":["https://osv.dev/vulnerability/GHSA-r77w-qph3-7vf8","https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8","https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76787c5a5bad875a","https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d","https://github.com/graphql-python/graphql-core","https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12","https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-r77w-qph3-7vf8","url":"https://osv.dev/vulnerability/GHSA-r77w-qph3-7vf8"}],"summary":"GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit"}