CVE-2026-40476

OVERVIEW CVE-2026-40476 is a denial-of-service vulnerability in graphql-go, a Go-based GraphQL implementation affecting versions 15.31.4 and below. The vulnerability exists in the OverlappingFieldsCanBeMerged validation rule, which performs quadratic (O(n²)) pairwise comparisons of fields with identical response names. An attacker can exploit this by crafting malicious GraphQL queries containing thousands of repeated identical fields to trigger excessive CPU consumption during the validation phase, before query execution even begins. SEVERITY The vulnerability requires an attacker to send a specifically crafted GraphQL query, representing a network-accessible attack vector with low complexity. The primary impact is availability, as the excessive validation processing consumes significant CPU resources and can cause application unresponsiveness. Notably, this vulnerability bypasses existing query depth and query complexity mitigation rules typically implemented by graphql-go users. The CVSS score is not yet assigned, though the FAUCET risk score of 36.0 and EPSS score of 0.000290 indicate relatively low overall severity within the vulnerability landscape. EXPLOITATION STATUS This vulnerability is not currently being actively exploited in the wild, as indicated by its inactive status on the KEV catalog and the very low EPSS percentile ranking. No public exploit code has been widely documented or released. Community attention appears minimal given the low EPSS score. The vulnerability was patched in version 15.31.5, and organizations running graphql-go should upgrade immediately to mitigate this denial-of-service risk.