CVE-2026-40476

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40476
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40476.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40476
Aliases
Published
2026-04-17T21:42:59.511Z
Modified
2026-07-08T08:13:41.597512486Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
Details

graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40476.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-407"
    ]
}
References

Affected packages

Git / github.com/webonyx/graphql-php

Affected ranges

Type
GIT
Repo
https://github.com/webonyx/graphql-php
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
089c4ef7e112df85788cfe06596278a8f99f4aa9
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:webonyx:graphql-php:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "15.31.5"
        }
    ]
}

Affected versions

v0.*
v0.1
v0.10.0
v0.10.0-rc1
v0.10.1
v0.10.2
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.11.5
v0.12.0
v0.12.1
v0.13.0
v0.2
v0.3
v0.4
v0.5
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.7.0
v0.7.1
v0.7.2
v0.8.0
v0.9.0
v0.9.1
v0.9.10
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9
v14.*
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.4.0
v14.4.1
v14.5.0
v14.5.1
v15.*
v15.0.0
v15.0.0-alpha.1
v15.0.0-alpha.2
v15.0.0-beta.1
v15.0.1
v15.0.2
v15.0.3
v15.1.0
v15.10.0
v15.11.0
v15.11.1
v15.11.2
v15.12.0
v15.12.1
v15.12.2
v15.12.3
v15.12.4
v15.12.5
v15.13.0
v15.14.0
v15.14.1
v15.14.2
v15.14.3
v15.15.0
v15.16.0
v15.16.1
v15.17.0
v15.18.0
v15.18.1
v15.19.0
v15.19.1
v15.2.0
v15.2.1
v15.2.2
v15.2.3
v15.2.4
v15.2.5
v15.20.0
v15.20.1
v15.21.0
v15.21.1
v15.21.2
v15.21.3
v15.22.0
v15.22.1
v15.22.2
v15.22.3
v15.22.4
v15.23.0
v15.23.1
v15.24.0
v15.25.0
v15.25.1
v15.25.2
v15.26.0
v15.27.0
v15.27.1
v15.27.2
v15.28.0
v15.29.0
v15.29.1
v15.29.2
v15.29.3
v15.29.4
v15.3.0
v15.3.1
v15.3.2
v15.30.0
v15.30.1
v15.30.2
v15.31.0
v15.31.1
v15.31.2
v15.31.3
v15.31.4
v15.4.0
v15.5.0
v15.5.1
v15.5.2
v15.5.3
v15.6.0
v15.6.1
v15.6.2
v15.6.3
v15.7.0
v15.8.0
v15.8.1
v15.9.0
v15.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40476.json"