CVE-2026-119286

Received Received - Intake

GraphQL-core ValidationAbortedError Memory Exhaustion

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: GitHub, Inc.

Description

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-29

Last Modified

2026-10-29

Generated

2026-10-30

AI Q&A

2026-10-30

EPSS Evaluated

N/A

NVD

CVE-2026-119286

EUVD

EUVD-2026-113404

Affected Vendors & Products

Vendor	Product	Version / Range
graphql-python	graphql-core	>= 3.3.0a3, < 3.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

GraphQL-core is a Python implementation of GraphQL. A flaw in versions 3.3.0a3 to 3.3.1 allows an unauthenticated attacker to submit a small document with over 100 validation errors. The validate() function reuses a module-level exception, appending traceback frames for each error. This causes unbounded memory growth as the process retains document, context, and error data indefinitely, eventually exhausting memory without accessing or altering data.

Detection Guidance

Detecting this vulnerability requires monitoring for memory exhaustion during GraphQL query validation. Check for repeated validation errors in logs and unusual memory spikes in GraphQL-core processes. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to crash your application or server by consuming all available memory. This leads to denial-of-service conditions, disrupting service availability for legitimate users. No data exposure or modification occurs, but prolonged downtime may impact operations.

Mitigation Strategies

Upgrade GraphQL-core to version 3.3.1 or later to fix the issue. If immediate upgrade is not possible, restrict unauthenticated access to GraphQL endpoints and monitor for excessive validation errors.

Hi! I’m here to help you understand CVE-2026-119286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70