GraphQL-core CVE-2026-119286 (GHSA-mpqx-q82w-9x46): memory leak denial of service when validation is aborted after max_errors (unauthenticated queries make the Python process grow until it's killed). Which versions are affected?

What it is: A high-severity advisory published 2026-10-30 for GraphQL-core, the Python GraphQL implementation used by Graphene, Strawberry, Ariadne and others. When a query produced more validation errors than max_errors (100 by default), validate() raised one shared module-level exception object. Each re-raise added to that object's traceback, which kept every aborted query's document and errors in memory for the life of the process. Any client could send small invalid queries without logging in, and because validation runs before execution, depth and complexity limits don't help; memory grew until the process was restarted or killed. Am I affected: - graphql-core 3.3.0a3 up to (not including) 3.3.1. The 3.2 line is not affected, and per the advisory GraphQL.js isn't either. - Check: pip show graphql-core (it's usually a dependency of your GraphQL framework, so check the lockfile). Fix: 1. Upgrade to graphql-core 3.3.1 or later (pip install -U "graphql-core>=3.3.1", or update your framework and lockfile), then redeploy. 2. If you can't yet, staying on or moving back to the 3.2 line avoids this bug, if your framework supports it. 3. Keep general protections in place: request size limits, rate limiting on the GraphQL endpoint, and worker memory limits with automatic restarts so a leak can't take the service down for long. Verify: pip show graphql-core reports 3.3.1+ (or 3.2.x), and process memory stays flat under a load test of invalid queries. Sources: https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46 https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1 https://nvd.nist.gov/vuln/detail/CVE-2026-119286