{"id":"CVE-2026-107376","published":"2026-10-08T18:17:22.373","lastModified":"2026-10-08T21:34:48.800","description":"webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\\Language\\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwes":["CWE-674"],"vendors":[],"products":[],"references":[{"url":"https://github.com/webonyx/graphql-php/commit/6c1d6009a0f7557f66753bcfd07badd15acf77f4","tags":[]},{"url":"https://github.com/webonyx/graphql-php/commit/7b7f2080ca5f7d5340a696fc5701b19a9222d2c2","tags":[]},{"url":"https://github.com/webonyx/graphql-php/releases/tag/v15.32.3","tags":[]},{"url":"https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq","tags":[]},{"url":"https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq","tags":[]}],"exploitRefs":[{"url":"https://github.com/webonyx/graphql-php/commit/6c1d6009a0f7557f66753bcfd07badd15acf77f4","tags":[]},{"url":"https://github.com/webonyx/graphql-php/commit/7b7f2080ca5f7d5340a696fc5701b19a9222d2c2","tags":[]},{"url":"https://github.com/webonyx/graphql-php/releases/tag/v15.32.3","tags":[]},{"url":"https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq","tags":[]},{"url":"https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq","tags":[]}],"hasPoc":true,"ai":{"summary":"The webonyx graphql-php library has a recursive descent parser without recursion limits, allowing attackers to trigger stack exhaustion through deeply nested GraphQL queries that cause SIGSEGV and terminate PHP processes. This affects PHP-FPM workers and long-running processes.","exploitability":"Easy to exploit with no special preconditions - attackers can craft deeply nested GraphQL queries to exhaust the PHP stack and cause process termination.","blast_radius":"High impact across all applications using GraphQL endpoints with webonyx/graphql-php, particularly those running PHP-FPM or long-running processes that could be repeatedly terminated.","remediation":"Upgrade to version 15.32.3 immediately","detection":"No reliable host or network indicator is derivable from the published description.","tags":["graphql","denial-of-service","php","stack-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:16:56.880Z"}}