CVE-2026-40476

graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/webonyx/graphql-php/releases/tag/v15.31.5	Release Notes
https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/14/26

Configurations

Configuration 1 (hide)

cpe:2.3:a:webonyx:graphql-php:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) graphql-go es una implementación de GraphQL en Go. En las versiones 15.31.4 e inferiores, la regla de validación OverlappingFieldsCanBeMerged realiza comparaciones por pares O(n²) de campos que comparten el mismo nombre de respuesta. Un atacante puede enviar una consulta con miles de campos idénticos repetidos, causando un uso excesivo de la CPU durante la validación antes de que comience la ejecución. Esto no se mitiga por las reglas existentes de QueryDepth o QueryComplexity. Este problema ha sido solucionado en la versión 15.31.5.

Information

Published : 2026-04-17 22:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40476

Mitre link : CVE-2026-40476

CVE.ORG link : CVE-2026-40476

JSON object : View

Products Affected

webonyx

graphql-php

CWE

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2026-40476", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40476", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T14:53:06.028689Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "webonyx", "product": "graphql-php", "versions": [{"status": "affected", "version": "< 15.31.5"}]}]}], "published": "2026-04-17T22:16:33.360", "references": [{"url": "https://github.com/webonyx/graphql-php/releases/tag/v15.31.5", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/14/26", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n\u00b2) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5."}, {"lang": "es", "value": "graphql-go es una implementaci\u00f3n de GraphQL en Go. En las versiones 15.31.4 e inferiores, la regla de validaci\u00f3n OverlappingFieldsCanBeMerged realiza comparaciones por pares O(n\u00b2) de campos que comparten el mismo nombre de respuesta. Un atacante puede enviar una consulta con miles de campos id\u00e9nticos repetidos, causando un uso excesivo de la CPU durante la validaci\u00f3n antes de que comience la ejecuci\u00f3n. Esto no se mitiga por las reglas existentes de QueryDepth o QueryComplexity. Este problema ha sido solucionado en la versi\u00f3n 15.31.5."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webonyx:graphql-php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC1E7082-20B8-4812-A566-41D14B1B8B8D", "versionEndExcluding": "15.31.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}