GHSA-3h96-34p3-xm76

Source

https://github.com/advisories/GHSA-3h96-34p3-xm76

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h96-34p3-xm76/GHSA-3h96-34p3-xm76.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3h96-34p3-xm76

Published

2026-05-05T21:51:15Z

Modified

2026-05-05T22:09:47.011849Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

Details

GraphQL-Ruby's max_query_string_tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached.

In patched versions, the Ruby lexer does count these tokens.

GraphQL-CParser is not affected by this problem.

max_query_string_tokens was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:51:15Z",
    "cwe_ids": [
        "CWE-770"
    ],
    "severity": "MODERATE",
    "nvd_published_at": null
}

References

Affected packages

RubyGems / graphql

Package

Name: graphql
Purl: pkg:gem/graphql

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.6.0

Fixed

2.6.1

Affected versions

2.*

2.6.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h96-34p3-xm76/GHSA-3h96-34p3-xm76.json"

RubyGems / graphql

Package

Name: graphql
Purl: pkg:gem/graphql

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5.0

Fixed

2.5.26

Affected versions

2.*

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

2.5.9

2.5.10

2.5.11

2.5.12

2.5.13

2.5.14

2.5.15

2.5.16

2.5.17

2.5.18

2.5.19

2.5.20

2.5.21

2.5.22

2.5.23

2.5.24

2.5.25

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h96-34p3-xm76/GHSA-3h96-34p3-xm76.json"

RubyGems / graphql

Package

Name: graphql
Purl: pkg:gem/graphql

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0

Fixed

2.4.18

Affected versions

2.*

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7

2.4.8

2.4.9

2.4.10

2.4.11

2.4.12

2.4.13

2.4.14

2.4.15

2.4.16

2.4.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h96-34p3-xm76/GHSA-3h96-34p3-xm76.json"

RubyGems / graphql

Package

Name: graphql
Purl: pkg:gem/graphql

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.1

Fixed

2.3.23

Affected versions

2.*

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.3.10

2.3.11

2.3.12

2.3.13

2.3.14

2.3.15

2.3.16

2.3.17

2.3.18

2.3.19

2.3.20

2.3.21

2.3.22

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3h96-34p3-xm76/GHSA-3h96-34p3-xm76.json"