graphql-php vulnerabilities

2 known vulnerabilities in graphql-php from Webonyx. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  graphql-php: Uncontrolled Recursion

  CVE-2026-107376Oct 8, 2026Webonyx

  webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can subm

• 7.5 High severity

  graphql-php: Inefficient Algorithmic Complexity

  CVE-2026-40476Apr 17, 2026Webonyx

  graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated