{"items":[{"id":"NVI-00010591","kind":"vulnerability","title":"GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-vj8h-fx38-h3vc","CVE-2026-75507"],"plain_summary":"GitHub lists this reviewed advisory for graphql-core, graphql-core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0bb51afc3b81596ed17415d5a33102a1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-22T16:26:42.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5d4ba54bac04e58b59746bf859d1d4b0"},{"kind":"CVSS","as_of":"2026-10-23T22:17:00.110Z","value":"7.5 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-14f81ca29f87f432e38d660bd4a7d55d"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.600%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.48764. Missing scores are unknown.","source_id":"sr-0bb51afc3b81596ed17415d5a33102a1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5d4ba54bac04e58b59746bf859d1d4b0","url":"https://github.com/advisories/GHSA-vj8h-fx38-h3vc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vj8h-fx38-h3vc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"},{"id":"sr-14f81ca29f87f432e38d660bd4a7d55d","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75507","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-75507","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-04T09:58:54.704Z"},{"id":"sr-0bb51afc3b81596ed17415d5a33102a1","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-75507","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:45:16.079Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5d4ba54bac04e58b59746bf859d1d4b0"],"technology":"graphql-core","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n### Details\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.\n\nRepeating an inline fragment that selects the same response name at two nesting\nlevels multiplies the two effects. There was no comparison budget and no validation\ntimeout, so the rule ran to completion regardless of cost.\n\nThe cost is incurred in the **validation phase**, which is what makes this hard t","public_affected_ranges":[">= 3.0.0, < 3.2.12"]},{"certainty":"source_listed","source_ids":["sr-5d4ba54bac04e58b59746bf859d1d4b0"],"technology":"graphql-core","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n### Details\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.\n\nRepeating an inline fragment that selects the same response name at two nesting\nlevels multiplies the two effects. There was no comparison budget and no validation\ntimeout, so the rule ran to completion regardless of cost.\n\nThe cost is incurred in the **validation phase**, which is what makes this hard t","public_affected_ranges":[">= 3.3.0a1, < 3.3.0rc1"]}],"null_published_at":"2026-11-06T00:29:57.242Z","source_updated_at":"2026-10-22T16:26:42.000Z","source_disclosed_at":"2026-10-22T16:26:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T22:07:30.906Z"},{"id":"NVI-00010591","kind":"vulnerability","title":"GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-vj8h-fx38-h3vc","CVE-2026-75507"],"plain_summary":"GitHub lists this reviewed advisory for graphql-core, graphql-core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-06a971c48b0be52bf3e59b95dca2bf6a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-22T16:26:42.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5d4ba54bac04e58b59746bf859d1d4b0"},{"kind":"CVSS","as_of":"2026-10-23T22:17:00.110Z","value":"7.5 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-14f81ca29f87f432e38d660bd4a7d55d"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.600%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.48723. Missing scores are unknown.","source_id":"sr-06a971c48b0be52bf3e59b95dca2bf6a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5d4ba54bac04e58b59746bf859d1d4b0","url":"https://github.com/advisories/GHSA-vj8h-fx38-h3vc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vj8h-fx38-h3vc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"},{"id":"sr-14f81ca29f87f432e38d660bd4a7d55d","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75507","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-75507","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-04T09:58:54.704Z"},{"id":"sr-06a971c48b0be52bf3e59b95dca2bf6a","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-75507","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.286Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5d4ba54bac04e58b59746bf859d1d4b0"],"technology":"graphql-core","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n### Details\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.\n\nRepeating an inline fragment that selects the same response name at two nesting\nlevels multiplies the two effects. There was no comparison budget and no validation\ntimeout, so the rule ran to completion regardless of cost.\n\nThe cost is incurred in the **validation phase**, which is what makes this hard t","public_affected_ranges":[">= 3.0.0, < 3.2.12"]},{"certainty":"source_listed","source_ids":["sr-5d4ba54bac04e58b59746bf859d1d4b0"],"technology":"graphql-core","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n### Details\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.\n\nRepeating an inline fragment that selects the same response name at two nesting\nlevels multiplies the two effects. There was no comparison budget and no validation\ntimeout, so the rule ran to completion regardless of cost.\n\nThe cost is incurred in the **validation phase**, which is what makes this hard t","public_affected_ranges":[">= 3.3.0a1, < 3.3.0rc1"]}],"null_published_at":"2026-11-04T10:04:35.912Z","source_updated_at":"2026-10-22T16:26:42.000Z","source_disclosed_at":"2026-10-22T16:26:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T22:07:30.906Z"},{"id":"NVI-00010591","kind":"vulnerability","title":"GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vj8h-fx38-h3vc","CVE-2026-75507"],"plain_summary":"GitHub lists this reviewed advisory for graphql-core, graphql-core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-06a971c48b0be52bf3e59b95dca2bf6a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-22T16:26:42.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5d4ba54bac04e58b59746bf859d1d4b0"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.600%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.48723. Missing scores are unknown.","source_id":"sr-06a971c48b0be52bf3e59b95dca2bf6a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5d4ba54bac04e58b59746bf859d1d4b0","url":"https://github.com/advisories/GHSA-vj8h-fx38-h3vc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vj8h-fx38-h3vc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"},{"id":"sr-06a971c48b0be52bf3e59b95dca2bf6a","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-75507","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.286Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5d4ba54bac04e58b59746bf859d1d4b0"],"technology":"graphql-core","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n### Details\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.\n\nRepeating an inline fragment that selects the same response name at two nesting\nlevels multiplies the two effects. There was no comparison budget and no validation\ntimeout, so the rule ran to completion regardless of cost.\n\nThe cost is incurred in the **validation phase**, which is what makes this hard t","public_affected_ranges":[">= 3.0.0, < 3.2.12"]},{"certainty":"source_listed","source_ids":["sr-5d4ba54bac04e58b59746bf859d1d4b0"],"technology":"graphql-core","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n### Details\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.\n\nRepeating an inline fragment that selects the same response name at two nesting\nlevels multiplies the two effects. There was no comparison budget and no validation\ntimeout, so the rule ran to completion regardless of cost.\n\nThe cost is incurred in the **validation phase**, which is what makes this hard t","public_affected_ranges":[">= 3.3.0a1, < 3.3.0rc1"]}],"null_published_at":"2026-11-02T20:21:07.825Z","source_updated_at":"2026-10-22T16:26:42.000Z","source_disclosed_at":"2026-10-22T16:26:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T22:07:30.906Z"},{"id":"NVI-00010591","kind":"vulnerability","title":"GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vj8h-fx38-h3vc","CVE-2026-75507"],"plain_summary":"GitHub lists this reviewed advisory for graphql-core, graphql-core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5d4ba54bac04e58b59746bf859d1d4b0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-22T16:26:42.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5d4ba54bac04e58b59746bf859d1d4b0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5d4ba54bac04e58b59746bf859d1d4b0","url":"https://github.com/advisories/GHSA-vj8h-fx38-h3vc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vj8h-fx38-h3vc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:30.906Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5d4ba54bac04e58b59746bf859d1d4b0"],"technology":"graphql-core","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n### Details\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.\n\nRepeating an inline fragment that selects the same response name at two nesting\nlevels multiplies the two effects. There was no comparison budget and no validation\ntimeout, so the rule ran to completion regardless of cost.\n\nThe cost is incurred in the **validation phase**, which is what makes this hard t","public_affected_ranges":[">= 3.0.0, < 3.2.12"]},{"certainty":"source_listed","source_ids":["sr-5d4ba54bac04e58b59746bf859d1d4b0"],"technology":"graphql-core","known_exclusions":[],"conditions_summary":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and\nin the worst case `O(n²·m²)` — running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before any resolver runs. Because the rule is part of `specified_rules`\nand therefore enabled by default, every GraphQL-core based server is affected at\ndefault settings.\n\n### Details\n\n`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response\nname and recurses into their sub-selections. The memoization added for\nCVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it\ndoes not cover this path: inline fragments are flattened into the parent selection\nset before the cache is consulted, and therefore every pair is re-compared from\nscratch at every nesting level.\n\nRepeating an inline fragment that selects the same response name at two nesting\nlevels multiplies the two effects. There was no comparison budget and no validation\ntimeout, so the rule ran to completion regardless of cost.\n\nThe cost is incurred in the **validation phase**, which is what makes this hard t","public_affected_ranges":[">= 3.3.0a1, < 3.3.0rc1"]}],"null_published_at":"2026-10-31T22:27:09.624Z","source_updated_at":"2026-10-22T16:26:42.000Z","source_disclosed_at":"2026-10-22T16:26:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:30.906Z"}],"next_cursor":null,"snapshot_revision":"42594"}