Description
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
graphql-python graphql-core
>= 3.2.3, < 3.2.12affected>= 3.3.0a3, < 3.3.0rc1affected
References
- https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8 ↗
- https://github.com/graphql-python/graphql-core/commit/437dea102e92fdf05a2971ca76787c5a5bad875a ↗
- https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d ↗
- https://github.com/graphql-python/graphql-core/releases/tag/v3.2.12 ↗
- https://github.com/graphql-python/graphql-core/releases/tag/v3.3.0rc1 ↗