graphql-python graphql-core

• CVE-2026-119286 High 7.5 GraphQL-core: Denial of service via memory leak in aborted validations 0.4%
• CVE-2026-75507 High 7.5 GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule 0.6%
• CVE-2026-75508 High 7.5 GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit 0.6%