{"id":"CVE-2026-40476","aliases":["GHSA-68jq-c3rv-pcrr"],"url":"https://o3.security/vulnerability/CVE-2026-40476","summary":"graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation","details":"The `OverlappingFieldsCanBeMerged` validation rule exhibits quadratic time complexity when processing queries with many repeated fields sharing the same response name. An attacker can send a crafted query like `{ hello hello hello ... }` with thousands of repeated fields, causing excessive CPU usage during validation before execution begins.\n\nThis is not mitigated by existing QueryDepth or QueryComplexity rules.\n\n**Observed impact (tested on v15.31.4):**\n- 1000 fields: ~0.6s\n- 2000 fields: ~2.4s\n- 3000 fields: ~5.3s\n- 5000 fields: request timeout (>20s)\n\n**Root cause:** `collectConflictsWithin()` performs O(n²) pairwise comparisons of all fields with the same response name. For identical repeated fields, every comparison returns \"no conflict\" but the quadratic iteration count causes resource exhaustion.\n\n**Fix:** Deduplicate structurally identical fields before pairwise comparison, reducing the complexity from O(n²) to O(u²) where u is the number of unique field signatures (typically 1 for this attack pattern).\n\n**Credit:** Ashwak N (ashwakn04@gmail.com)","published":"2026-04-17T21:42:59.511Z","modified":"2026-09-16T03:30:57.766211024Z","cvss":null,"epss":{"score":0.00485,"percentile":0.39413,"asOf":"2026-08-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"webonyx/graphql-php","fixedVersion":"15.31.5"}],"fix":null,"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/09/14/26"},{"type":"WEB","url":"https://github.com/webonyx/graphql-php/releases/tag/v15.31.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40476.json"},{"type":"ADVISORY","url":"https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40476"},{"type":"PACKAGE","url":"https://github.com/webonyx/graphql-php"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-16T03:30:57.766211024Z"}}