Skip to content
OpenAdvisories

Vendor

webonyx

2 known vulnerabilities.

Products

graphql-php 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.9
    CVE-2026-40476

    graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

    graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated…

    webonyx graphql-php webonyx/graphql-php Packagist