CVE-2026-119286

HIGH 7.5

GraphQL-core: Denial of service via memory leak in aborted validations

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.

CWE	CWE-400 CWE-401
Vendor	graphql-python
Product	graphql-core
Published	Oct 29, 2026

Stay Ahead of the Next One

Get instant alerts for graphql-python graphql-core

Be the first to know when new high vulnerabilities affecting graphql-python graphql-core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

graphql-python / graphql-core

>= 3.3.0a3, < 3.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46 github.com: https://github.com/graphql-python/graphql-core/issues/287 github.com: https://github.com/graphql-python/graphql-core/pull/288 github.com: https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9 github.com: https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1