ETK-2026-4098Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4098",
  "cve_id": null,
  "display_id": "ETK-2026-4098",
  "ghsa_id": "GHSA-qv9r-jc8m-v7ph",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Exponential denial of service in graphql-ruby fragment handling",
  "summary": "graphql-ruby installations before the fixed release can consume rapidly increasing resources when processing GraphQL queries with deeply composed fragment spreads. An attacker who can submit such queries may degrade availability, including where query-size or complexity controls are in use.",
  "mitigation": "Upgrade the graphql gem to version 2.6.15. Until upgrades are complete, restrict untrusted GraphQL query submission and apply request-rate and resource limits.",
  "vendor": "rubygems",
  "product": "rubygems:graphql",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, <= 2.6.14"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "2.6.15"
      ],
      "package_name": "graphql",
      "purl": "pkg:gem/graphql"
    }
  ],
  "cwes": [
    407
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.329450033333334,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-09T19:35:29+00:00",
      "days": -1.4655280652083333,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T06:45:50.666111+00:00",
      "url": "https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-qv9r-jc8m-v7ph"
    }
  }
}