rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-40425 MacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External Parties
The administrator account for the

Danelec MacGregor Voyage Data Recorder
web interface can directly edit sensitive files related to authentication, potentially changing the root password.
Problem types: cwe_id: CWE-552
description: CWE-552
Affected products: vendor: Danelec
product: MacGregor Voyage Data Recorder (VDR) G4e
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.7
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Credits: lang: en
value: Andrew Tierney of Pen Test Partners reported these vulnerabilities to CISA.
Published: 2026-05-29T17:47:17.918Z
CVE-2026-40431 SenseLive X3050 Cleartext transmission of sensitive information
A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencrypted HTTP for all administrative communication. Because management traffic, including authentication attempts and configuration data, is transmitted in cleartext, an attacker with access to the same network segment could intercept or observe sensitive operational information.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext transmission of sensitive information
Affected products: vendor: SenseLive
product: X3050
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Credits: lang: en
value: Jithin Nambiar J reported these vulnerabilities to CISA.
Published: 2026-04-23T23:56:49.967Z
CVE-2026-40434 Anviz CrossChex Standard Improper Verification of Source of a Communication Channel
Anviz CrossChex Standard
lacks source verification in the client/server channel, enabling TCP 
packet injection by an attacker on the same network to alter or disrupt 
application traffic.
Problem types: cwe_id: CWE-940
description: CWE-940
Affected products: vendor: Anviz
product: Anviz CrossChex Standard
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Published: 2026-04-17T19:49:28.099Z
CVE-2026-40435 BIG-IP httpd access control vulnerability
When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-420
description: CWE-420: Unprotected Alternate Channel
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: F5
Published: 2026-05-13T14:12:27.268Z
CVE-2026-40436 ZTE ZXEDM iEMS product has a password reset vulnerability
The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to the user list acquisition function, attackers can read all user list information through the user list interface. Attackers can reset the passwords of obtained user information, causing risks such as unauthorized operations.
Problem types: description: CWE‑269 Improper Privilege Management
Affected products: vendor: ZTE
product: ZXEDM iEMS
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Wenwei Shi
Published: 2026-04-13T06:31:49.372Z
CVE-2026-40446 
Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
Problem types: cwe_id: CWE-843
description: CWE-843 Access of resource using incompatible type ('type confusion')
Affected products: vendor: Samsung Open Source
product: Escargot
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.9
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Credits: lang: en
value: Sebastián Alba Vives / @Sebasteuo
Published: 2026-04-13T04:56:09.635Z
CVE-2026-40447 
Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer overflow or wraparound
Affected products: vendor: Samsung Open Source
product: Escargot
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: Sebastián Alba Vives / @Sebasteuo
Published: 2026-04-13T05:06:38.362Z
CVE-2026-40448 
Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung Open Source ONE.
Affected version is prior to commit  1.30.0.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer overflow or wraparound
Affected products: vendor: Samsung Open Source
product: ONE
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
Credits: lang: en
value: Sebastián Alba Vives
Published: 2026-04-22T05:40:26.361Z
CVE-2026-40449 
Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source ONE.
Affected version is prior to commit  1.30.0.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer overflow or wraparound
Affected products: vendor: Samsung Open Source
product: ONE
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.6
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Credits: lang: en
value: Sebastián Alba Vives
Published: 2026-04-22T05:51:35.259Z
CVE-2026-40450 
Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption for oversized tensors.
Affected version is prior to commit  1.30.0.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer overflow or wraparound
Affected products: vendor: Samsung Open Source
product: ONE
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.6
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Credits: lang: en
value: Sebastián Alba Vives
Published: 2026-04-22T05:53:10.536Z
CVE-2026-40451 
DeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to execute arbitrary script in a user's browser, and inject malicious HTML into web pages viewed by the user.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: DeepL
product: Chrome browser extension
Published: 2026-04-22T04:28:49.657Z
CVE-2026-40453 Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection
The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant Camel internal headers, which are then resolved by downstream components such as camel-exec and camel-file using their canonical casing. This enables remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components.

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.

Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
Problem types: cwe_id: CWE-178
description: CWE-178 Improper Handling of Case Sensitivity
Affected products: vendor: Apache Software Foundation
product: Apache Camel JMS
default_status: unaffected
vendor: Apache Software Foundation
product: Apache Camel CoAP
default_status: unaffected
vendor: Apache Software Foundation
product: Apache Camel Google PubSub
default_status: unaffected
Credits: lang: en
value: Saroj Khadka
Published: 2026-04-27T08:23:20.354Z
CVE-2026-40458 Cross-Site Request Forgery in PAC4J
PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to know the victim’s CSRF token or its hash prior to the attack. Collisions in the deterministic String.hashCode() function can be computed directly, reducing the effective token's security space to 32 bits. This bypasses CSRF protection, allowing profile updates, password changes, account linking, and any other state-changing operations to be performed without the victim's consent.

This issue was fixed in PAC4J versions 5.7.10 and 6.4.1
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: PAC4J
product: PAC4J
default_status: unaffected
Credits: lang: en
value: Bartłomiej Dmitruk, striga.ai
Published: 2026-04-17T13:18:26.308Z
CVE-2026-40459 LDAP Injection in PAC4J
PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.

This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1
Problem types: cwe_id: CWE-90
description: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Affected products: vendor: PAC4J
product: PAC4J
default_status: unaffected
Credits: lang: en
value: Bartłomiej Dmitruk, striga.ai
Published: 2026-04-17T13:18:39.181Z
CVE-2026-40460 NGINX ngx_quic_module vulnerability
When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-290
description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: F5
product: NGINX Plus
default_status: unknown
vendor: F5
product: NGINX Open Source
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: F5 acknowledges Rodrigo Laneth of Miralium Research for bringing this issue to our attention and following the highest standards of coordinated disclosure.
Published: 2026-05-13T14:12:45.291Z
CVE-2026-40461 Anviz Products Missing Authentication for Critical Function
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug 
settings (e.g., enabling SSH), allowing unauthorized state changes that 
can facilitate later compromise.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Anviz
product: Anviz CX7 Firmware
default_status: unaffected
vendor: Anviz
product: Anviz CX2 Lite Firmware
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: 2026-04-17T19:36:29.842Z
CVE-2026-40462 iControl REST and tmsh vulnerability
Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: F5
Published: 2026-05-13T14:12:28.473Z
CVE-2026-40466 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.



An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().


This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Apache Software Foundation
product: Apache ActiveMQ Broker
default_status: unaffected
vendor: Apache Software Foundation
product: Apache ActiveMQ All
default_status: unaffected
vendor: Apache Software Foundation
product: Apache ActiveMQ
default_status: unaffected
Credits: lang: en
value: Fatih Ersinadim
lang: en
value: gggggggga
Published: 2026-04-24T10:15:44.445Z
CVE-2026-40470 Hackage package and doc upload stored XSS vulnerability
A critical XSS vulnerability affected hackage-server and
hackage.haskell.org.  HTML and JavaScript files provided in source
packages or via the documentation upload facility were served
as-is on the main hackage.haskell.org domain.  As a consequence,
when a user with latent HTTP credentials browses to the package
pages or documentation uploaded by a malicious package maintainer,
their session can be hijacked to upload packages or
documentation, amend maintainers or other package metadata, or
perform any other action the user is authorised to do.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseSeverity: CRITICAL
baseScore: 9.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Published: 2026-04-23T14:53:47.724Z
CVE-2026-40471 Hackage CSRF vulnerability
hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
version: 3.1
Published: 2026-04-23T14:56:34.979Z
CVE-2026-40472 Hackage package metadata stored XSS vulnerability
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML
href attributes without proper sanitization, enabling stored
Cross-Site Scripting (XSS) attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseSeverity: CRITICAL
baseScore: 9.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Published: 2026-04-23T15:00:09.063Z
CVE-2026-40473 Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP
The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject().

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.

Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Camel Mina
default_status: unaffected
Credits: lang: en
value: Venkatraman Kumar from Securin
Published: 2026-04-27T07:51:59.134Z
CVE-2026-40474 wger has Broken Access Control in the Global Gym Configuration Update Endpoint
wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() side effects that bulk-update user profile gym assignments — a vertical privilege escalation to installation-wide configuration control. This issue is fixed in version 2.5.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: wger-project
product: wger
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Published: 2026-04-17T21:39:03.677Z
CVE-2026-40476 graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated identical fields, causing excessive CPU usage during validation before execution begins. This is not mitigated by existing QueryDepth or QueryComplexity rules. This issue has been fixed in version 15.31.5.
Problem types: cwe_id: CWE-407
description: CWE-407: Inefficient Algorithmic Complexity
Affected products: vendor: webonyx
product: graphql-php
Published: 2026-04-17T21:42:59.511Z