CVE-2026-40476

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40476", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-13T19:50:42.113Z", "datePublished": "2026-04-17T21:42:59.511Z", "dateUpdated": "2026-09-14T20:07:48.694Z"}, "containers": {"cna": {"title": "graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr"}, {"name": "https://github.com/webonyx/graphql-php/releases/tag/v15.31.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/webonyx/graphql-php/releases/tag/v15.31.5"}], "affected": [{"vendor": "webonyx", "product": "graphql-php", "versions": [{"version": "< 15.31.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T21:42:59.511Z"}, "descriptions": [{"lang": "en", "value": "graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n\u00b2) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5."}], "source": {"advisory": "GHSA-68jq-c3rv-pcrr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T14:53:06.028689Z", "id": "CVE-2026-40476", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:56:57.812Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/14/26"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-14T20:07:48.694Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/14/26"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-14T20:07:48.694Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40476", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T14:53:06.028689Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:53:07.583Z"}}], "cna": {"title": "graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation", "source": {"advisory": "GHSA-68jq-c3rv-pcrr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "webonyx", "product": "graphql-php", "versions": [{"status": "affected", "version": "< 15.31.5"}]}], "references": [{"url": "https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr", "name": "https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/webonyx/graphql-php/releases/tag/v15.31.5", "name": "https://github.com/webonyx/graphql-php/releases/tag/v15.31.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n\u00b2) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T21:42:59.511Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40476", "state": "PUBLISHED", "dateUpdated": "2026-09-14T20:07:48.694Z", "dateReserved": "2026-04-13T19:50:42.113Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T21:42:59.511Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "graphql-php", "vendor": "webonyx", "versions": [{"status": "affected", "version": "< 15.31.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webonyx:graphql-php:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC1E7082-20B8-4812-A566-41D14B1B8B8D", "versionEndExcluding": "15.31.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n\u00b2) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5."}, {"lang": "es", "value": "graphql-go es una implementaci\u00f3n de GraphQL en Go. En las versiones 15.31.4 e inferiores, la regla de validaci\u00f3n OverlappingFieldsCanBeMerged realiza comparaciones por pares O(n\u00b2) de campos que comparten el mismo nombre de respuesta. Un atacante puede enviar una consulta con miles de campos id\u00e9nticos repetidos, causando un uso excesivo de la CPU durante la validaci\u00f3n antes de que comience la ejecuci\u00f3n. Esto no se mitiga por las reglas existentes de QueryDepth o QueryComplexity. Este problema ha sido solucionado en la versi\u00f3n 15.31.5."}], "id": "CVE-2026-40476", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40476", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T14:53:06.028689Z", "version": "2.0.3"}}]}, "published": "2026-04-17T22:16:33.360", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/webonyx/graphql-php/releases/tag/v15.31.5"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/14/26"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,15.31.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "graphql-php", "source": "cna", "vendor": "webonyx"}, "product": "graphql-php", "vendor": "webonyx"}], "analysis": {"en": {"generated_at": "2026-04-18T08:52:49.049470+00:00", "value": {"mitigation_remediation": ["Upgrade to version 15.31.5 or later of graphql-php to remove the quadratic complexity.", "Apply any additional query depth or complexity limits to restrict large requests at the API gateway level.", "Monitor server CPU load and network traffic for anomalous spikes that could indicate an ongoing denial\u2011of\u2011service attempt."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected vendors are represented by webonyx:graphql-php. The flaw appears in all versions up to and including 15.31.4. The issue is corrected in version\u202f15.31.5 and later.", "description_and_impact": "The vulnerability resides in the OverlappingFieldsCanBeMerged validation rule of the graphql-php library, which performs pairwise comparisons of fields that share a response name. In versions 15.31.4 and below, the algorithm scales quadratically (O(n\u00b2)), so an attacker can craft a query containing thousands of identical fields. When processed, the server expends excessive CPU time validating the request before any execution occurs, which can exhaust resources and result in a denial of service.", "risk_and_exploitability": "The CVSS vector assigns a score of 6.9, indicating moderate impact, but the lack of an EPSS score and absence from the KEV list suggest exploitation is not yet documented or common. The attack requires ability to send arbitrary GraphQL queries to the endpoint; no authentication or privilege escalation is needed. Exploitation is straightforward: an attacker submits a large query, causing the server to consume disproportionate CPU, potentially impacting all users."}}}}, "created": "2026-04-18T09:00:05.896209+00:00", "updated": "2026-04-20T14:59:30.431020+00:00", "vendors": ["webonyx", "webonyx$PRODUCT$graphql-php"]}