CVE-2026-75507

Published 22 October 2026 · tracked since 23 October 2026

Description

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation p

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-98957
• CVE-2026-98958
• CVE-2026-98959
• CVE-2026-98960
• CVE-2026-98961
• CVE-2026-98962
• CVE-2026-98963
• CVE-2026-98964
• CVE-2026-98949
• CVE-2026-98950

→ Open the live CVE board · all tools