Description
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
graphql-python graphql-core
>= 3.0.0, < 3.2.12affected>= 3.3.0a1, < 3.3.0rc1affected
References
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc ↗
- https://github.com/graphql-python/graphql-core/commit/150e59814d97d12140be005a558c93188ef89198 ↗
- https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7 ↗
- https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12 ↗
- https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1 ↗