graphql-go is a Go implementation of GraphQL.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 17, 2026 · NIST NVD

   Detected

   graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or Que

2. Sep 14, 2026 · NIST NVD

   Updated

   graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or Que

Affected

• cpe webonyx/graphql-phpversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-40476

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-40476

  graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, ca

  nvd.nist.gov

References

• Reference · openwall.com
• Release Notes · github.com
• Vendor Advisory · github.com