GraphQL-core EUVD-2026-108226

No special conditions beyond the product being reachable: the OverlappingFieldsCanBeMerged rule ships in specified_rules and is enabled by default, so every GraphQL-core server at default settings is vulnerable with no authentication and no user interaction (PR:N/UI:N). The attacker only needs to submit a crafted query that repeats an inline fragment selecting the same response name at two nesting levels. Limiting factors are narrow: impact is availability-only (no data disclosed or modified), and the flaw is fixed by upgrading to 3.2.12 or 3.3.0rc1, which enforces a default 250,000-comparison budget (MAX_FIELD_COMPARISONS). Per-field-depth or complexity limiters do NOT mitigate it because they run after validation; the only stated pre-upgrade workaround is rejecting oversized documents measured on the DECOMPRESSED body, and removing the rule is explicitly not safe because it is a spec-required correctness rule.

All severity signals point the same direction: the supplied CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction (UI:N) attack with high availability impact and no confidentiality or integrity impact - a clean denial-of-service profile scoring 7.5. The GHSA advisory confirms the mechanism end-to-end (quadratic/O(n²·m²) CPU in the OverlappingFieldsCanBeMerged validation rule) and includes a working proof-of-concept with measured timings (364 KB query pinning one core for 319 s on 3.2.8), so the technical impact is verified, not inferred. No EPSS score and no CISA KEV entry were provided in the input, so there is no evidence of active exploitation; the only priority signal is the vuln.today Decision label 'this_week', which is consistent with a credible, easily-weaponizable unauthenticated DoS that is not yet confirmed exploited in the wild. The practical risk is elevated beyond a generic DoS because the cost lands in the validation phase, before resolvers or AST depth/complexity limiters run, and the payload is trivially shallow (depth 3, complexity 1) and highly compressible, so standard GraphQL defenses and compressed-body/WAF inspection do not catch it. This is a real this-week patching priority for any exposed GraphQL-core server, not a high-CVSS-but-low-real-risk issue; the only tempering factor is that impact is confined to availability.

An unauthenticated attacker sends a single small, highly compressible GraphQL query (one short inline-fragment string repeated at two nesting levels) to a public GraphQL-core endpoint. Validation enters the OverlappingFieldsCanBeMerged rule and burns minutes of CPU on one worker before any resolver runs; a handful of concurrent requests saturate a multi-worker deployment. A working proof-of-concept with measured timings is published in the GHSA advisory.