mediumCVSS 5.3Vulnerability

GHSA-3h96-34p3-xm76

GraphQL-Ruby's `max_query_string_tokens` configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this problem. `max_query_string_tokens` was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.

Properties

ghsa_id
GHSA-3h96-34p3-xm76
severity
medium
summary
GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens
cvss_score
5.3
cve_id
GHSA-3h96-34p3-xm76
cvss_vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
is_ghsa_only
true
ghsa_published
2026-05-05T21:51:15Z
source_url
https://github.com/advisories/GHSA-3h96-34p3-xm76
ghsa_updated
2026-05-05T21:51:16Z

Related Entities (4)

VULNERABLE_TO (1)

[Software]rubygems/graphql

AFFECTS (1)

[Software]rubygems/graphql

HAS_WEAKNESS (1)

[Weakness]Allocation of Resources Without Limits or Throttling

REPORTED_BY (1)

[Source]GitHub Advisory Database

Explore deeper with Ninja Signal's threat intelligence graph

GHSA-3h96-34p3-xm76 (CVSS 5.3) — Ninja Signal Threat Intelligence | Ninja Signal