CVE-2026-40476
Quadratic CPU Exhaustion in graphql-go OverlappingFields Validation
Publication date: 2026-04-17
Last updated on: 2026-04-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| graphql-go | graphql-go | to 15.31.5 (exc) |
| graphql-go | graphql-go | 15.31.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-407 | An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in graphql-go versions 15.31.4 and below, specifically in the OverlappingFieldsCanBeMerged validation rule. This rule performs O(n²) pairwise comparisons of fields that share the same response name. An attacker can exploit this by sending a query containing thousands of repeated identical fields, which causes excessive CPU usage during the validation phase before query execution.
This excessive CPU usage can degrade performance or potentially lead to denial of service conditions. The issue is not mitigated by existing QueryDepth or QueryComplexity rules and has been fixed in version 15.31.5.
How can this vulnerability impact me? :
This vulnerability can lead to excessive CPU consumption when processing specially crafted GraphQL queries with many repeated identical fields. This can degrade the performance of your application or service, potentially causing slowdowns or denial of service conditions during query validation.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade graphql-go to version 15.31.5 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in graphql-go allows an attacker to cause excessive CPU usage by sending queries with thousands of repeated identical fields, leading to potential denial of service during validation. However, there is no information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.