GHSA-3h96-34p3-xm76
GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens
GraphQL-Ruby's max_query_string_tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached.
In patched versions, the Ruby lexer does count these tokens.
GraphQL-CParser is not affected by this problem.
max_query_string_tokens was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score used
GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens
GraphQL-Ruby's max_query_string_tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached.
In patched versions, the Ruby lexer does count these tokens.
GraphQL-CParser is not affected by this problem.
max_query_string_tokens was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.
- Record
GHSA-3h96-34p3-xm76- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens
GraphQL-Ruby's max_query_string_tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached.
In patched versions, the Ruby lexer does count these tokens.
GraphQL-CParser is not affected by this problem.
max_query_string_tokens was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.
- Record
GHSA-3h96-34p3-xm76- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
graphqlRubyGems | 2.6.0 to 2.6.0 | 2.6.1 |
graphqlRubyGems | 2.5.0 up to 2.5.26 | 2.5.26 |
graphqlRubyGems | 2.4.0 up to 2.4.18 | 2.4.18 |
graphqlRubyGems | 2.3.1 up to 2.3.23 | 2.3.23 |
graphqlRubyGems | 2.6.0 up to 2.6.1 | 2.6.1 |
graphqlRubyGems | 2.5.0 up to 2.5.26, plus listed versions 2.5.12.5.102.5.112.5.122.5.13 Show 20 moreShow less2.5.142.5.152.5.162.5.172.5.182.5.192.5.22.5.202.5.212.5.222.5.232.5.242.5.252.5.32.5.42.5.52.5.62.5.72.5.82.5.9 | 2.5.26 |
graphqlRubyGems | 2.4.0 up to 2.4.18, plus listed versions 2.4.12.4.102.4.112.4.122.4.13 Show 12 moreShow less2.4.142.4.152.4.162.4.172.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.9 | 2.4.18 |
graphqlRubyGems | 2.3.1 up to 2.3.23, plus listed versions 2.3.102.3.112.3.122.3.132.3.14 Show 16 moreShow less2.3.152.3.162.3.172.3.182.3.192.3.22.3.202.3.212.3.222.3.32.3.42.3.52.3.62.3.72.3.82.3.9 | 2.3.23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-3h96-34p3-xm76 is a medium vulnerability (CVSS 5.3) in graphql, published May 5, 2026. No source lists public exploit code. Fixed in graphql 2.6.1.