GHSA-68jq-c3rv-pcrr
Suggest an improvement- Source
- https://github.com/advisories/GHSA-68jq-c3rv-pcrr
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-68jq-c3rv-pcrr/GHSA-68jq-c3rv-pcrr.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-68jq-c3rv-pcrr
- Aliases
-
- CVE-2026-40476
- Published
- 2026-04-14T01:05:05Z
- Modified
- 2026-05-05T16:05:13.632592Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
- Details
-
The
OverlappingFieldsCanBeMergedvalidation rule exhibits quadratic time complexity when processing queries with many repeated fields sharing the same response name. An attacker can send a crafted query like{ hello hello hello ... }with thousands of repeated fields, causing excessive CPU usage during validation before execution begins.This is not mitigated by existing QueryDepth or QueryComplexity rules.
Observed impact (tested on v15.31.4): - 1000 fields: ~0.6s - 2000 fields: ~2.4s - 3000 fields: ~5.3s - 5000 fields: request timeout (>20s)
Root cause:
collectConflictsWithin()performs O(n²) pairwise comparisons of all fields with the same response name. For identical repeated fields, every comparison returns "no conflict" but the quadratic iteration count causes resource exhaustion.Fix: Deduplicate structurally identical fields before pairwise comparison, reducing the complexity from O(n²) to O(u²) where u is the number of unique field signatures (typically 1 for this attack pattern).
Credit: Ashwak N (ashwakn04@gmail.com)
- Database specific
{ "cwe_ids": [ "CWE-407" ], "github_reviewed": true, "github_reviewed_at": "2026-04-14T01:05:05Z", "nvd_published_at": "2026-04-17T22:16:33Z", "severity": "MODERATE" }- References
Affected packages
Packagist / webonyx/graphql-php
Package
- Name
- webonyx/graphql-php
- Purl
- pkg:composer/webonyx/graphql-php
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed15.31.5