Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

graphql-core

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release
3.3.2 (Nov 6, 2026): no advisory affects it
Newest unaffected release
3.3.2 (Nov 6, 2026), the latest release
Advisories
3 · 3 high
Weekly downloads
17.9M
Dependents
1,157
Releases
114 since 0.4.9 (Nov 17, 2015)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-119286
    Affects 3.3.0a3 to 3.3.0 (3.3.1 is outside it)
  • CVE-2026-75507
    Affects 3.0.0 to 3.2.11 (3.2.12 is outside it); 3.3.0a1 to 3.3.0rc0 (3.3.0rc1 is outside it)
  • CVE-2026-75508
    Affects 3.2.3 to 3.2.11 (3.2.12 is outside it); 3.3.0a3 to 3.3.0rc0 (3.3.0rc1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • GraphQL-core: Denial of service via memory leak in aborted validations

    Affected: from 3.3.0a3, fixed in 3.3.1.

    Fixed in 3.3.1 (released Oct 25, 2026, 4 days before disclosure).

    The latest release, 3.3.2, is not affected.

  • GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

    Affected: from 3.0.0, fixed in 3.2.12; from 3.3.0a1, fixed in 3.3.0rc1.

    Fixed in 3.2.12 (released Aug 27, 2026, 56 days before disclosure) and 3.3.0rc1 (released Aug 27, 2026, 56 days before disclosure).

    The latest release, 3.3.2, is not affected.

  • GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

    Affected: from 3.2.3, fixed in 3.2.12; from 3.3.0a3, fixed in 3.3.0rc1.

    Fixed in 3.2.12 (released Aug 27, 2026, 56 days before disclosure) and 3.3.0rc1 (released Aug 27, 2026, 56 days before disclosure).

    The latest release, 3.3.2, is not affected.