Vulnerability Description
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76
- https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae
- https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12
- https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph
FAQ
What is CVE-2026-75508?
CVE-2026-75508 is a vulnerability with a CVSS score of 7.5 (HIGH). GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens ret...
How severe is CVE-2026-75508?
CVE-2026-75508 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75508?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.