The vulnerability resides in the OverlappingFieldsCanBeMerged validation rule of the graphql-php library, which performs pairwise comparisons of fields that share a response name. In versions 15.31.4 and below, the algorithm scales quadratically (O(n²)), so an attacker can craft a query containing thousands of identical fields. When processed, the server expends excessive CPU time validating the request before any execution occurs, which can exhaust resources and result in a denial of service.

Affected vendors are represented by webonyx:graphql-php. The flaw appears in all versions up to and including 15.31.4. The issue is corrected in version 15.31.5 and later.

The CVSS vector assigns a score of 6.9, indicating moderate impact, but the lack of an EPSS score and absence from the KEV list suggest exploitation is not yet documented or common. The attack requires ability to send arbitrary GraphQL queries to the endpoint; no authentication or privilege escalation is needed. Exploitation is straightforward: an attacker submits a large query, causing the server to consume disproportionate CPU, potentially impacting all users.