{"schema":"threatline.record/2","record":{"id":"CVE-2026-107376","aliases":["GHSA-r7cg-qjjm-xhqq"],"summary":"webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input","details":"webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\\Language\\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3.","categories":["Runtimes & languages"],"product":"graphql-php","vendor":"webonyx","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107376","source_modified_at":"2026-10-08T18:39:56.356Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"graphql-php","vendor":"webonyx","versions":[{"status":"affected","version":"< 15.32.3"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r7cg-qjjm-xhqq","source_modified_at":"2026-10-09T02:56:06.053115899Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"name":"webonyx/graphql-php","ecosystem":"Packagist","purl":"pkg:composer/webonyx/graphql-php"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.32.3"}]}],"versions":["14.10.0","v0.1","v0.10.0","v0.10.0-rc1","v0.10.1","v0.10.2","v0.11.0","v0.11.1","v0.11.2","v0.11.3","v0.11.4","v0.11.5","v0.11.6","v0.12.0","v0.12.1","v0.12.2","v0.12.3","v0.12.4","v0.12.5","v0.12.6","v0.13.0","v0.13.1","v0.13.2","v0.13.3","v0.13.4","v0.13.5","v0.13.6","v0.13.7","v0.13.8","v0.13.9","v0.2","v0.3","v0.4","v0.5","v0.5.1","v0.5.2","v0.5.3","v0.5.4","v0.5.5","v0.5.6","v0.5.7","v0.5.8","v0.5.9","v0.6.0","v0.6.1","v0.6.2","v0.6.3","v0.6.4","v0.7.0","v0.7.1"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r7cg-qjjm-xhqq","source_modified_at":"2026-10-09T02:56:06.053115899Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"name":"webonyx/graphql-php","ecosystem":"Packagist","purl":"pkg:composer/webonyx/graphql-php"},"version":"15.32.3"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00449,"percentile":0.38035,"score_date":"2026-10-23"},"published_at":"2026-10-08T17:49:57.113Z","modified_at":"2026-10-09T02:56:06.053115899Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107376","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-08T18:39:56.356Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-r7cg-qjjm-xhqq","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-10-09T02:56:06.053115899Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107376","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/webonyx/graphql-php/commit/6c1d6009a0f7557f66753bcfd07badd15acf77f4","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/webonyx/graphql-php/commit/7b7f2080ca5f7d5340a696fc5701b19a9222d2c2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/webonyx/graphql-php/releases/tag/v15.32.3","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-08T18:39:30.355689Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-09T02:56:06.053115899Z","content_hash":"8f35cb6770757d63d65c58234ab6c5c890d75d35e66334cfb999af071779d382"}}