graphql-core 3.3.0rc1

v3.3.0rc1

on Python PyPI

Release candidate GraphQL-core v3.3.0rc1, based on GraphQL.js v17.0.0rc0.

This release candidate supports Python 3.10 to 3.14.

This is a security release. It fixes two denial-of-service vulnerabilities in the validator and the parser. Upgrading is recommended for all users of the 3.3 line.

Unlike the other releases in this series, v3.3.0rc1 does not correspond to a GraphQL.js release tag. It is a security release cut while the port of GraphQL.js v17 is still in progress, so the tracked version_js deliberately remains v17.0.0rc0.

Security fixes:

• CVE-2026-75507 (GHSA-vj8h-fx38-h3vc, High) — the OverlappingFieldsCanBeMerged validation rule could be driven into quadratic and worse running time by a small, highly compressible query using repeated inline fragments, occupying a worker for minutes of CPU during validation, before any resolver runs. Validation now enforces a per-document comparison budget and aborts with a GraphQLError once it is exhausted.
• CVE-2026-75508 (GHSA-r77w-qph3-7vf8, High) — comment tokens were allocated and retained but not counted toward the parser's max_tokens limit, so a comment-padded document could bypass the limit while allocating one token object per comment. max_tokens now counts every token the parser consumes, including skipped comments.

Please note the two behaviour changes this implies:

• A pathological query that previously validated — slowly — now produces a validation error. Realistic queries stay far below the limit, which defaults to 250,000 field comparisons and can be adjusted by assigning to graphql.validation.rules.overlapping_fields_can_be_merged.MAX_FIELD_COMPARISONS.
• Comments now count toward max_tokens, so a comment-heavy document that was previously accepted may now be rejected. If you parse documents with substantial comments and set max_tokens, you may need to raise the limit. The token_count of a parsed document now includes comments as well.

Both limits complement, but do not replace, a request body-size limit applied to the decompressed request body in your web framework.

Apart from these, there are no breaking changes after the last release candidate 3.3.0rc0.

Other notable changes:

• Incremental delivery (@defer and @stream) has been re-implemented on a new work-queue execution architecture, replacing the previous scheduling approach. This makes the delivery order of incremental payloads well defined and fixes a class of ordering and lifetime bugs at its root rather than case by case.
• Fixed a hang on a specification-invalid query combining @defer and @stream, where a request could stop producing payloads and never complete.
• Fixed streams whose producers stayed parked on a back-pressured queue and were never released.
• Fixed an invalid-state error that could occur when a sibling @deferred fragment failed.
• Invalid fragment variables now raise a request error instead of failing later.
• Directives are now applied correctly when an SDL document contains both type definitions and type extensions carrying directives.

The security issues have been reported by @BZHunt, who also reviewed the fixes before release. In memory of ZaX, who was the driving force behind this discovery. The first one was also independently found and diagnosed by @bcmyguest.

Thanks to @jkimbo for sponsoring this project.