GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22258-1 advisory.

    Changes in python-graphql-core:

    - CVE-2026-75507: Fix quadratic complexity in OverlappingFieldsCanBeMerged       validation rule when comparing nested inline fragments. (bsc#1287830)
    - CVE-2026-75508: Count skipped comment tokens toward the parser max_tokens       limit to prevent memory exhaustion. (bsc#1287829)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and
    3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share
    response names and recursively re-compares flattened inline fragments during the validation phase. The
    prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive
    quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control
    runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins
    a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and
    3.3.0rc1. (CVE-2026-75507)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and     3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share     response names and recursively re-compares flattened inline fragments during the validation phase. The     prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive     quadratic and worst-case O(nm) CPU work before any resolver or AST-based depth or complexity control     runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins     a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and     3.3.0rc1. (CVE-2026-75507)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
379534	openSUSE 16 Security Update : python-graphql-core (openSUSE-SU-2026:22258-1)	Nessus	SuSE Local Security Checks	Local	high
477147	Chainguard: elastic-connectors-8.19: security update to 8.19.23-r2	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
477147	Chainguard: elastic-connectors-8.19: security update to 8.19.23-r2	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
371260	Linux Distros Unpatched Vulnerability : CVE-2026-75507	Nessus	Misc.	Local	high
476826	SCA: security update for graphql-core (GHSA-vj8h-fx38-h3vc)	Tenable Cloud Security	SCA Checks	Local	high
476826	SCA: security update for graphql-core (GHSA-vj8h-fx38-h3vc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-75507

high

Tenable Plugins

high

high

high

high

high

high