CVE-2026-107376
8.2 HIGHpublic exploit availablePublished 2026-10-08 · Updated 2026-10-08
AI risk analysis
- Summary
- The webonyx graphql-php library has a recursive descent parser without recursion limits, allowing attackers to trigger stack exhaustion through deeply nested GraphQL queries that cause SIGSEGV and terminate PHP processes. This affects PHP-FPM workers and long-running processes.
- Exploitability
- Easy to exploit with no special preconditions - attackers can craft deeply nested GraphQL queries to exhaust the PHP stack and cause process termination.
- Blast radius
- High impact across all applications using GraphQL endpoints with webonyx/graphql-php, particularly those running PHP-FPM or long-running processes that could be repeatedly terminated.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 15.32.3 immediately
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-674
Public exploit & PoC references
- https://github.com/webonyx/graphql-php/commit/6c1d6009a0f7557f66753bcfd07badd15acf77f4
- https://github.com/webonyx/graphql-php/commit/7b7f2080ca5f7d5340a696fc5701b19a9222d2c2
- https://github.com/webonyx/graphql-php/releases/tag/v15.32.3
- https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq
- https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq
All references
- https://github.com/webonyx/graphql-php/commit/6c1d6009a0f7557f66753bcfd07badd15acf77f4
- https://github.com/webonyx/graphql-php/commit/7b7f2080ca5f7d5340a696fc5701b19a9222d2c2
- https://github.com/webonyx/graphql-php/releases/tag/v15.32.3
- https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq
- https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-102276PoC
- HIGHCVE-2026-102497
- HIGHCVE-2026-102278PoC
- HIGHCVE-2026-102281PoC
- HIGHCVE-2026-104020PoC
- HIGHCVE-2026-107216PoC
- HIGHCVE-2026-107300PoC
- HIGHCVE-2026-61551PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.