{"id":"ghsa-ghsa-vj8h-fx38-h3vc","seq":309574,"kind":"advisory","title":"GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule","url":"https://github.com/advisories/GHSA-vj8h-fx38-h3vc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vj8h-fx38-h3vc","summary":"影響: pip:graphql-core >= 3.0.0, < 3.2.12 → 3.2.12, pip:graphql-core >= 3.3.0a1, < 3.3.0rc1 → 3.3.0rc1\nThe OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and in the worst case O(n²·m²) — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Because the rule is part of specified_rules and therefore enabled by default, every GraphQL-core based server is affected at default settings. Details OverlappingFieldsCanBeMerged compares every pair of fields that sha…","severity":"high","techs":["python"],"cves":["CVE-2026-75507"],"tags":["GHSA-vj8h-fx38-h3vc","graphql-core","graphql-core"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:26:40.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}