ETK-2026-2595Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2595",
  "cve_id": null,
  "display_id": "ETK-2026-2595",
  "ghsa_id": "GHSA-mpqx-q82w-9x46",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Memory exhaustion in graphql-core validation",
  "summary": "graphql-core 3.3.0 can retain validation state after requests exceed the configured validation-error limit. An unauthenticated client can repeatedly submit invalid GraphQL documents to grow process memory and cause denial of service. Validation occurs before execution, so execution-focused query limits do not prevent this condition.",
  "mitigation": "Upgrade graphql-core to version 3.3.1. Until upgraded, clear the shared validation-abort error traceback after each validation where the application can wrap the validation function.",
  "vendor": "pip",
  "product": "pip:graphql-core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.3.0a3, < 3.3.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.3.1"
      ],
      "package_name": "graphql-core",
      "purl": "pkg:pypi/graphql-core"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.42331135,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-25T09:36:13+00:00",
      "days": -0.2323468803125,
      "is_lower_bound": true,
      "measured_at": "2026-10-25T15:10:47.936286+00:00",
      "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46"
    },
    "trigger_signal": {
      "at": "2026-10-25T09:36:13+00:00",
      "days": -0.2323468803125,
      "is_lower_bound": true,
      "measured_at": "2026-10-25T15:10:47.936286+00:00",
      "url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46"
    }
  }
}