GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1,
    validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends
    frames to the reused exception's traceback on every raise, retaining each document, validation context,
    and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document
    with more than 100 validation errors to cause unbounded memory growth before query execution, eventually
    exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.
    (CVE-2026-119286)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1,     validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends     frames to the reused exception's traceback on every raise, retaining each document, validation context,     and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document     with more than 100 validation errors to cause unbounded memory growth before query execution, eventually     exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.
    (CVE-2026-119286)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478100	SCA: security update for graphql-core (GHSA-mpqx-q82w-9x46)	Tenable Cloud Security	SCA Checks	Local	high
478100	SCA: security update for graphql-core (GHSA-mpqx-q82w-9x46)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
374490	Linux Distros Unpatched Vulnerability : CVE-2026-119286	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-119286

high

Tenable Plugins

high

high

high