{"id":"CVE-2026-119286","kind":"vulnerability","aliases":["CVE-2026-119286"],"related":[],"title":"graphql-core: validation error reuse leaks memory, can exhaust server workers","description":"GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.","summary":"graphql-core, a Python GraphQL library, keeps a shared validation error object that grows its traceback on every oversized document, so memory is never released. An unauthenticated client sending small invalid queries can drive memory use up until the worker process is exhausted, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graphql","graphql-core","package","python"],"not_affected_if":["auth-required","internal-only"],"how_to_check":"- Check the installed version with `pip show graphql-core` and look for versions from `3.3.0a3` up to but not including `3.3.1`.\n- Search lock files (`poetry.lock`, `requirements.txt`, `uv.lock`) for `graphql-core` pinned to those versions.\n- Confirm whether a Python service using it accepts queries from untrusted clients.","fix":"- `graphql-core` `3.3.1`","status":"open","published_at":"2026-10-29T22:17:01+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","triaged_at":"2026-10-29T22:28:42+00:00","updated_at":"2026-10-29T22:28:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T22:28:42Z","model":"claude-haiku-5-5","output":{"fix":"- `graphql-core` `3.3.1`","reach":"internet","title":"graphql-core: validation error reuse leaks memory, can exhaust server workers","impact":"medium","summary":"graphql-core, a Python GraphQL library, keeps a shared validation error object that grows its traceback on every oversized document, so memory is never released. An unauthenticated client sending small invalid queries can drive memory use up until the worker process is exhausted, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","graphql","graphql-core"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"worker memory grows until the process is exhausted","analyst_note":"","how_to_check":"- Check the installed version with `pip show graphql-core` and look for versions from `3.3.0a3` up to but not including `3.3.1`.\n- Search lock files (`poetry.lock`, `requirements.txt`, `uv.lock`) for `graphql-core` pinned to those versions.\n- Confirm whether a Python service using it accepts queries from untrusted clients.","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","internal-only"],"who_is_affected":"Python services that use graphql-core 3.3.0a3 through 3.3.0 patch releases, and that accept GraphQL queries from clients the team does not control, are exposed. Services pinned to earlier releases or that never validate untrusted documents are less exposed. Services limited to trusted internal callers are lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4214,"output_tokens":570,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119286':15A,18A '-2026':14A,17A '100':139C '3.3.0':86C '3.3.1':89C,165C 'a3':87C 'append':104C 'caus':69B,143C 'client':53B,129C 'context':119C 'core':3A,22B,27B,75C 'cve':13A,16A 'data':158C 'denial':70B 'disclos':155C 'document':45B,99C,117C,135C 'drive':59B 'error':5A,36B,102C,121C,141C 'eventu':150C 'everi':43B,113C 'exceed':100C 'except':109C 'execut':149C 'exhaust':10A,68B,151C 'fix':162C 'frame':105C 'graphql':2A,19B,21B,26B,30B,74C 'graphql-cor':1A,20B,25B,73C 'graphql.js':82C 'grow':39B 'growth':146C 'implement':84C 'invalid':56B 'issu':160C 'keep':32B 'leak':7A 'level':95C 'librari':31B 'lifetim':126C 'max':101C 'memori':8A,47B,60B,145C,153C 'modifi':157C 'modul':94C 'module-level':93C 'never':49B 'object':37B 'overs':44B 'packag':23B 'port':79C 'process':66B,125C 'python':24B,29B,78C,103C 'queri':57B,148C 'rais':114C 'refer':83C 'releas':50B 'repeat':131C 'retain':115C 'reus':6A,91C,108C 'send':54B 'server':11A 'servic':72B 'set':122C 'share':34B 'small':55B,134C 'submit':132C 'traceback':41B,111C 'unauthent':52B,128C 'unbound':144C 'use':61B 'valid':4A,35B,90C,118C,140C 'validationabortederror':96C 'version':164C 'without':154C 'worker':12A,65B,152C","nicknames":[],"mitigations":[],"who_affected":"Python services that use graphql-core 3.3.0a3 through 3.3.0 patch releases, and that accept GraphQL queries from clients the team does not control, are exposed. Services pinned to earlier releases or that never validate untrusted documents are less exposed. Services limited to trusted internal callers are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T22:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119286","severity":null,"published_at":"2026-10-29T22:17:01+00:00","modified_at":"2026-10-29T22:17:01+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","fetched_at":"2026-10-29T22:27:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}