All vulnerabilities
CVE-2026-107376GHSA-r7cg-qjjm-xhqq

webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input

webonyx graphql-phpPackagistRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 8 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.32.3Fixed versionOSV
Published8 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 15.32.3webonyx/graphql-php, PackagistOSVcomposer require "webonyx/graphql-php:^15.32.3"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3.

Text from CVE List

Affected versions 52

  • graphql-phpaffected: < 15.32.3CVE List
  • webonyx/graphql-php, Packagistfrom first release, fixed in 15.32.3OSV
  • webonyx/graphql-php, Packagist14.10.0OSV
  • webonyx/graphql-php, Packagistv0.1OSV
  • webonyx/graphql-php, Packagistv0.10.0OSV
  • webonyx/graphql-php, Packagistv0.10.0-rc1OSV
  • webonyx/graphql-php, Packagistv0.10.1OSV
  • webonyx/graphql-php, Packagistv0.10.2OSV
  • webonyx/graphql-php, Packagistv0.11.0OSV
  • webonyx/graphql-php, Packagistv0.11.1OSV
  • webonyx/graphql-php, Packagistv0.11.2OSV
  • webonyx/graphql-php, Packagistv0.11.3OSV
  • webonyx/graphql-php, Packagistv0.11.4OSV
  • webonyx/graphql-php, Packagistv0.11.5OSV
  • webonyx/graphql-php, Packagistv0.11.6OSV
  • webonyx/graphql-php, Packagistv0.12.0OSV
  • webonyx/graphql-php, Packagistv0.12.1OSV
  • webonyx/graphql-php, Packagistv0.12.2OSV
  • webonyx/graphql-php, Packagistv0.12.3OSV
  • webonyx/graphql-php, Packagistv0.12.4OSV
  • webonyx/graphql-php, Packagistv0.12.5OSV
  • webonyx/graphql-php, Packagistv0.12.6OSV
  • webonyx/graphql-php, Packagistv0.13.0OSV
  • webonyx/graphql-php, Packagistv0.13.1OSV
  • webonyx/graphql-php, Packagistv0.13.2OSV
  • webonyx/graphql-php, Packagistv0.13.3OSV
  • webonyx/graphql-php, Packagistv0.13.4OSV
  • webonyx/graphql-php, Packagistv0.13.5OSV
  • webonyx/graphql-php, Packagistv0.13.6OSV
  • webonyx/graphql-php, Packagistv0.13.7OSV
  • webonyx/graphql-php, Packagistv0.13.8OSV
  • webonyx/graphql-php, Packagistv0.13.9OSV
  • webonyx/graphql-php, Packagistv0.2OSV
  • webonyx/graphql-php, Packagistv0.3OSV
  • webonyx/graphql-php, Packagistv0.4OSV
  • webonyx/graphql-php, Packagistv0.5OSV
  • webonyx/graphql-php, Packagistv0.5.1OSV
  • webonyx/graphql-php, Packagistv0.5.2OSV
  • webonyx/graphql-php, Packagistv0.5.3OSV
  • webonyx/graphql-php, Packagistv0.5.4OSV
  • webonyx/graphql-php, Packagistv0.5.5OSV
  • webonyx/graphql-php, Packagistv0.5.6OSV
  • webonyx/graphql-php, Packagistv0.5.7OSV
  • webonyx/graphql-php, Packagistv0.5.8OSV
  • webonyx/graphql-php, Packagistv0.5.9OSV
  • webonyx/graphql-php, Packagistv0.6.0OSV
  • webonyx/graphql-php, Packagistv0.6.1OSV
  • webonyx/graphql-php, Packagistv0.6.2OSV
  • webonyx/graphql-php, Packagistv0.6.3OSV
  • webonyx/graphql-php, Packagistv0.6.4OSV
  • webonyx/graphql-php, Packagistv0.7.0OSV
  • webonyx/graphql-php, Packagistv0.7.1OSV

References 4