## GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-75507
- 公開日時: 2026-10-22T16:26:40.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-vj8h-fx38-h3vc)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-vj8h-fx38-h3vc

影響: pip:graphql-core >= 3.0.0, < 3.2.12 → 3.2.12, pip:graphql-core >= 3.3.0a1, < 3.3.0rc1 → 3.3.0rc1
The OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and in the worst case O(n²·m²) — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Because the rule is part of specified_rules and therefore enabled by default, every GraphQL-core based server is affected at default settings. Details OverlappingFieldsCanBeMerged compares every pair of fields that sha…