{"action":"Upgrade graphql to 2.3.23 or later.","affected":[{"fixed":"2.6.1","introduced":"2.6.0"},{"fixed":"2.5.26","introduced":"2.5.0"},{"fixed":"2.4.18","introduced":"2.4.0"},{"fixed":"2.3.23","introduced":"2.3.1"}],"component":"graphql","cve_ids":[],"ecosystem":"RubyGems","exploited":false,"fixed_versions":["2.6.1","2.5.26","2.4.18","2.3.23"],"ghsa_id":"GHSA-3h96-34p3-xm76","id":"tcs_01M5KEGA6G6EE7E3ACQVFN1NBD","modified_at":"2026-05-05T22:09:47.011849Z","published_at":"2026-05-05T21:51:15Z","references":["https://osv.dev/vulnerability/GHSA-3h96-34p3-xm76","https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76","https://github.com/rmosolgo/graphql-ruby"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-3h96-34p3-xm76","url":"https://osv.dev/vulnerability/GHSA-3h96-34p3-xm76"}],"summary":"GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens"}