THREAT OPS › Threat News › [NVD] CVE-2026-40476 (HIGH 7.5) — graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, ca
[NVD] CVE-2026-40476 (HIGH 7.5) — graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, ca
CVE-2026-40476 CVSS: 7.5 HIGH Published: 2026-04-17T22:16:33.360
graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before exe
Indicators of compromise
- CVE-2026-40476cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-40476