Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40476 graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of f… https://www.cve.org/CVERecord?id=CVE-2026-40476
Post summary
CVE-2026-40476 is a newly disclosed vulnerability in graphql-go (≤15.31.4) that causes O(n²) comparisons in the OverlappingFieldsCanBeMerged rule, potentially leading to performance degradation.
CVE-2026-40476 Denial of Service via Quadratic Field Validation in graphql-go 15.31.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40476
Post summary
This excerpt announces a new CVE-2026-40476, a DoS vulnerability in graphql-go 15.31.4, without providing PoCs, exploits, or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | webonyx | graphql-php | - | - | - |