PT-2026-33213 · Unknown · Graphql-Go

Ashwak N · Published 2026-04-14 · Updated 2026-05-21 · CVE-2026-40476

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions graphql-go versions prior to 15.31.5

Description The OverlappingFieldsCanBeMerged validation rule exhibits quadratic time complexity when processing queries containing numerous repeated fields that share the same response name. Specifically, the collectConflictsWithin() function performs O(n²) pairwise comparisons of these fields. An attacker can exploit this by sending a crafted query with thousands of identical fields, leading to excessive CPU usage and resource exhaustion during the validation phase, before execution begins. This issue is not mitigated by existing QueryDepth or QueryComplexity rules.

Recommendations Update to version 15.31.5.

Fix

DoS

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2026-40476

GHSA-68JQ-C3RV-PCRR

Affected Products

Graphql-Go

References · 8

• https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68jq-c3rv-pcrr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40476 · Security Note
• https://github.com/webonyx/graphql-php · Note
• https://github.com/webonyx/graphql-php/releases/tag/v15.31.5 · Note
• https://twitter.com/VulmonFeeds/status/2045380917972107368 · Twitter Post
• https://t.me/cveNotify/164429 · Telegram Post
• https://twitter.com/CVEnew/status/2045467375898665287 · Twitter Post