Skip to content
OpenAdvisories

Package · Packagist

webonyx/graphql-php

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.9
    CVE-2026-40476

    graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

    graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated…

    webonyx graphql-php webonyx/graphql-php Packagist