CVE-2026-119286highCWE-400CWE-401

CVE-2026-119286: high-severity vulnerability in graphql-python graphql-core

GraphQL-core: Denial of service via memory leak in aborted validations

Published · Updated

Follow this CVE+ Monitor graphql-core+ Monitor graphql-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.4%
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
graphql-python · graphql-core
Related CVEs — graphql-python graphql-core

In the same product, most dangerous first.

CVE-2026-75507HIGHGraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation ruleEPSS 0.6%CVE-2026-75508HIGHGraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitEPSS 0.6%