GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

影響: pip:graphql-core >= 3.0.0, < 3.2.12 → 3.2.12, pip:graphql-core >= 3.3.0a1, < 3.3.0rc1 → 3.3.0rc1

The OverlappingFieldsCanBeMerged validation rule can be driven into quadratic — and in the worst case O(n²·m²) — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Because the rule is part of specified_rules and therefore enabled by default, every GraphQL-core based server is affected at default settings. Details OverlappingFieldsCanBeMerged compares every pair of fields that sha…

在 GitHub Advisory Database 阅读

2026/10/23 01:26，GitHub Advisory Database 发布了“GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。CVE：CVE-2026-75507。