SUSE alert openSUSE-SU-2026:22258-1 (python-graphql-core) [LWN.net]

From:
 
[email protected]


To:
 
[email protected]


Subject:
 
openSUSE-SU-2026:22258-1: important: Security update for python-graphql-core


Date:
 
Tue, 10 Nov 2026 17:56:19 +0100


Message-ID:
 
<[email protected]>


Archive-link:
 
Article


openSUSE security update: security update for python-graphql-core

————————————————————-
Announcement ID: openSUSE-SU-2026:22258-1

Rating: important

References:
  * bsc#1287829

  * bsc#1287830
Cross-References:
  * CVE-2026-75507

  * CVE-2026-75508
Affected Products:
         openSUSE Leap 16.0
————————————————————-
An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.
Description:
This update for python-graphql-core fixes the following issues:
Changes in python-graphql-core:
– CVE-2026-75507: Fix quadratic complexity in OverlappingFieldsCanBeMerged

  validation rule when comparing nested inline fragments. (bsc#1287830)

– CVE-2026-75508: Count skipped comment tokens toward the parser max_tokens

  limit to prevent memory exhaustion. (bsc#1287829)
Patch instructions:
   To install this openSUSE security update use the suse recommended installation methods

   like YaST online_update or “zypper patch”.

   Alternatively you can run the command listed for your product:
– openSUSE Leap 16.0
   zypper in -t patch openSUSE-Leap-16.0-packagehub-735=1
Package List:
– openSUSE Leap 16.0:
  python313-graphql-core-3.2.6-bp160.2.1
References:
  * www.suse.com/security/cve/CVE-2026-75507.html

  * www.suse.com/security/cve/CVE-2026-75508.html