CVE-2026-107376: webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input
webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
webonyx/graphql-phpto a version that resolves this vulnerability.Fixed in 15.32.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Any deployment using webonyx/graphql-php before 15.32.3 that accepts attacker-controlled GraphQL input is exposed. The impact includes PHP-FPM workers and long-running Swoole, RoadRunner, ReactPHP, or CLI processes.
What does an attacker need to exploit it?
An attacker only needs network access to submit a crafted, deeply nested GraphQL input. The vulnerable parser can be triggered with nested selection sets, object or list values, or list types, without authentication or user interaction.
Do GraphQL validation or query complexity limits prevent exploitation?
No. The stack exhaustion occurs during parsing, before query validation and complexity controls run.
What happens when exploitation succeeds?
The PHP process can hit a stack overflow and receive SIGSEGV, terminating the affected worker or long-running process. Application-level exception handling cannot catch this condition.
What version resolves the issue?
Upgrade webonyx/graphql-php to version 15.32.3, which fixes the unbounded parser recursion.