CVE-2026-75507

{
  "etk_id": "ETK-2026-2475",
  "cve_id": "CVE-2026-75507",
  "display_id": "CVE-2026-75507",
  "ghsa_id": "GHSA-vj8h-fx38-h3vc",
  "euvd_id": "EUVD-2026-108226",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Algorithmic denial of service in graphql-core validation",
  "summary": "graphql-core versions before 3.2.12 and 3.3.0rc1 can spend excessive CPU time validating GraphQL requests with repeated inline fragments. An unauthenticated remote client can exhaust worker capacity by sending such requests to a service that validates queries with the default rules.",
  "mitigation": "Upgrade graphql-core to 3.2.12 or 3.3.0rc1. Until upgraded, enforce a size limit on decompressed GraphQL request bodies before validation.",
  "vendor": "pip",
  "product": "pip:graphql-core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, < 3.2.12"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.2.12"
      ],
      "package_name": "graphql-core",
      "purl": "pkg:pypi/graphql-core"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.3.0a1, < 3.3.0rc1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.3.0rc1"
      ],
      "package_name": "graphql-core",
      "purl": "pkg:pypi/graphql-core"
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 16.642841866666668,
  "t0_at": "2026-10-22T16:12:38.424000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-22T18:04:51.440241+00:00",
      "days": 0.07792842871527778,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T16:12:38.424000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-22T16:26:40+00:00",
      "days": 0.009740462962962963,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T16:12:38.424000+00:00",
      "url": "https://github.com/advisories/GHSA-vj8h-fx38-h3vc"
    },
    "trigger_signal": {
      "at": "2026-10-22T16:12:38.424000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T16:12:38.424000+00:00",
      "url": "https://github.com/advisories/GHSA-vj8h-fx38-h3vc"
    }
  }
}