CVE-2026-75508

Name of the Vulnerable Software and Affected Versions GraphQL-core versions 3.2.3 through 3.2.11 GraphQL-core version 3.3.0rc1 (prior to fix)

Description An unauthenticated remote attacker can cause a denial of service through memory exhaustion. The issue exists because the max tokens limit in Parser.advance lexer() only counts non-comment tokens. While Lexer.lookahead() skips comments, each skipped comment is still allocated as a Token object and retained in memory via token.next and token.prev. A highly compressible document padded with numerous comments can bypass the max tokens check while consuming significant resident memory, potentially triggering an Out-Of-Memory (OOM) kill of the worker process. This occurs before AST-based depth or complexity controls are executed.

Recommendations Update GraphQL-core to version 3.2.12 or 3.3.0rc1. As a mitigation measure, apply a request body-size limit to the decompressed body before it reaches the parse() function.