Memory Exhaustion via Comment-Padded GraphQL Documents in GraphQL-core

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: GitHub, Inc.

Description

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-75508

Affected Vendors & Products

Vendor	Product	Version / Range
graphql-python	graphql-core	>= 3.2.3, < 3.2.12
graphql-python	graphql-core	>= 3.3.0a3, < 3.3.0rc1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects GraphQL-core versions 3.2.3 to 3.2.12 and 3.3.0rc1. The parser's max_tokens limit only counts non-comment tokens, but each skipped comment is still allocated as a Token and retained. This allows an attacker to create a highly compressible document with many comments that passes the token limit while consuming excessive memory, leading to memory exhaustion before other controls activate.

Impact Analysis

An unauthenticated remote attacker could exploit this to exhaust server memory by sending specially crafted GraphQL requests. This may cause the server to crash, degrade performance, or become unresponsive, potentially leading to denial-of-service conditions for legitimate users.

Mitigation Strategies

Upgrade graphql-core to version 3.2.12 or later, or 3.3.0rc1 or later to address the memory exhaustion issue caused by comment-padded GraphQL documents.

Hi! I’m here to help you understand CVE-2026-75508. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70