CVE Explorer

CVE-2026-40476

graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:7f58b167e1b37b8484be9b88786d5bded1817816d9281f8e042c0b58009aebf4

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"graphql-php","vendor":"webonyx","versions":[{"status":"affected","version":"< 15.31.5"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:2ba0b4ffac5e65251e1b37fb270302f455a6110563e36f3c4c72e3531f43e14f · sha256:ee37c9de743d49b0… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:2ba0b4ffac5e65251e1b37fb270302f455a6110563e36f3c4c72e3531f43e14f · sha256:ee37c9de743d49b0… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-407","description":"CWE-407: Inefficient Algorithmic Complexity","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:2ba0b4ffac5e65251e1b37fb270302f455a6110563e36f3c4c72e3531f43e14f · sha256:ee37c9de743d49b0… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"https://github.com/webonyx/graphql-php/releases/tag/v15.31.5","tags":["x_refsource_MISC"],"url":"https://github.com/webonyx/graphql-php/releases/tag/v15.31.5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2ba0b4ffac5e65251e1b37fb270302f455a6110563e36f3c4c72e3531f43e14f · sha256:ee37c9de743d49b0… · /containers/cna/references/1

{"name":"https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr","tags":["x_refsource_CONFIRM"],"url":"https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2ba0b4ffac5e65251e1b37fb270302f455a6110563e36f3c4c72e3531f43e14f · sha256:ee37c9de743d49b0… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer