PT-2026-41402 · Rubygems · Graphql
Published
2026-05-05
·
Updated
2026-05-05
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
GraphQL-Ruby's
max query string tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached.In patched versions, the Ruby lexer does count these tokens.
GraphQL-CParser is not affected by this problem.
max query string tokens was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Graphql