mediumCVSS 5.3Vulnerability
GHSA-3h96-34p3-xm76
GraphQL-Ruby's `max_query_string_tokens` configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this problem. `max_query_string_tokens` was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.
Properties
- ghsa_id
- GHSA-3h96-34p3-xm76
- severity
- medium
- summary
- GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens
- cvss_score
- 5.3
- cve_id
- GHSA-3h96-34p3-xm76
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- is_ghsa_only
- true
- ghsa_published
- 2026-05-05T21:51:15Z
- source_url
- https://github.com/advisories/GHSA-3h96-34p3-xm76
- ghsa_updated
- 2026-05-05T21:51:16Z
Related Entities (4)
VULNERABLE_TO (1)
←[Software]rubygems/graphql
AFFECTS (1)
→[Software]rubygems/graphql
HAS_WEAKNESS (1)
→[Weakness]Allocation of Resources Without Limits or Throttling
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph