graphql-core
PyPI3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting graphql-corepage 1 of 1
- CVE-2026-119286HIGHCVSS 7.5EG 7.5fixed in 3.3.12026-10-29
vulnerable: 3.3.0 ... 3.3.0rc1 (18 versions)
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's…
- CVE-2026-75507HIGHCVSS 7.5EG 7.5fixed in 3.2.12 or 3.3.0rc1, by version range2026-10-22
vulnerable: 3.0.0 ... 3.2.9 (35 versions)
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively r…
- CVE-2026-75508HIGHCVSS 7.5EG 7.5fixed in 3.2.12 or 3.3.0rc1, by version range2026-10-22
vulnerable: 3.2.10 ... 3.2.9 (9 versions)
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comme…
Check whether graphql-core is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for graphql-core CVEs against the assets you own.
Book a Demo →