SUSE alert openSUSE-SU-2026:22258-1 (python-graphql-core) [LWN.net]

admin 






From:
 
[email protected]




To:
 
[email protected]




Subject:
 
openSUSE-SU-2026:22258-1: important: Security update for python-graphql-core




Date:
 
Tue, 10 Nov 2026 17:56:19 +0100




Message-ID:
 
<[email protected]>




Archive-link:
 
Article





openSUSE security update: security update for python-graphql-core

————————————————————-


Announcement ID: openSUSE-SU-2026:22258-1

Rating: important

References:


  * bsc#1287829

  * bsc#1287830


Cross-References:


  * CVE-2026-75507

  * CVE-2026-75508


Affected Products:


         openSUSE Leap 16.0


————————————————————-


An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.


Description:


This update for python-graphql-core fixes the following issues:


Changes in python-graphql-core:


– CVE-2026-75507: Fix quadratic complexity in OverlappingFieldsCanBeMerged

  validation rule when comparing nested inline fragments. (bsc#1287830)

– CVE-2026-75508: Count skipped comment tokens toward the parser max_tokens

  limit to prevent memory exhaustion. (bsc#1287829)


Patch instructions:


   To install this openSUSE security update use the suse recommended installation methods

   like YaST online_update or “zypper patch”.

   Alternatively you can run the command listed for your product:


– openSUSE Leap 16.0


   zypper in -t patch openSUSE-Leap-16.0-packagehub-735=1


Package List:


– openSUSE Leap 16.0:


  python313-graphql-core-3.2.6-bp160.2.1


References:


  * www.suse.com/security/cve/CVE-2026-75507.html

  * www.suse.com/security/cve/CVE-2026-75508.html



            


Read more here: Source link