CVE-2026-119286

{
  "etk_id": "ETK-2026-3012",
  "cve_id": "CVE-2026-119286",
  "display_id": "CVE-2026-119286",
  "ghsa_id": "GHSA-mpqx-q82w-9x46",
  "euvd_id": "EUVD-2026-113404",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Memory exhaustion flaw in graphql-core validation",
  "summary": "graphql-core versions from 3.3.0a3 through versions before 3.3.1 can retain validation-related objects across failed requests, increasing process memory use. An unauthenticated remote client may exhaust worker memory by repeatedly sending requests that reach the validation error limit, if the application accepts such requests and invokes graphql-core validation.",
  "mitigation": "Upgrade graphql-core to version 3.3.1. Until upgrades are complete, restrict or rate-limit unauthenticated GraphQL requests, especially invalid-request traffic.",
  "vendor": "graphql-python",
  "product": "graphql-core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.3.0a3, < 3.3.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.3.1"
      ],
      "package_name": "graphql-core",
      "purl": "pkg:pypi/graphql-core"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.568868666666667,
  "t0_at": "2026-10-29T21:38:43.633000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-25T09:36:13+00:00",
      "days": -4.5017434375,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T21:38:43.633000+00:00",
      "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46"
    },
    "trigger_signal": {
      "at": "2026-10-25T09:36:13+00:00",
      "days": -4.5017434375,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T21:38:43.633000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119286"
    }
  }
}