CVE-2026-75507
Description
A flaw was found in GraphQL-core. An unauthenticated remote attacker could cause a Denial of Service (DoS) by submitting a specially crafted query with nested inline fragments. During query validation, repeated field comparisons consume excessive CPU resources before complexity limits can be enforced, potentially exhausting worker processes and disrupting service availability.
Statement
This vulnerability is rated as Important severity because unauthenticated remote network requests can consume excessive CPU resources to trigger worker starvation and service-wide denial of service. In Red Hat environments, the issue primarily impacts services that expose public GraphQL APIs utilizing vulnerable graphql-core validation pipelines. Because the computational overhead occurs during the initial document validation phase, standard AST depth limiters and downstream query complexity checks fail to prevent resource exhaustion.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
