CVE-2026-107376: 
PHP vulnerability analysis and mitigation

CVE-2026-107376 is an uncontrolled recursion vulnerability in webonyx/graphql-php, a widely used PHP implementation of the GraphQL specification. The GraphQL\Language\Parser class performs recursive descent parsing without any recursion depth limit in parseSelectionSet, parseValueLiteral, and parseTypeReference, allowing a remote unauthenticated attacker to submit deeply nested GraphQL queries that exhaust the PHP process stack and trigger an uncatchable SIGSEGV crash. All versions prior to 15.32.3 are affected; the issue was disclosed on April 24, 2026, and fixed in version 15.32.3 released the same day. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is CWE-674 (Uncontrolled Recursion): the Parser class in src/Language/Parser.php contains no recursionDepth field, no maxRecursionDepth option, and no guard in any of its mutually recursive methods (parseValueLiteral, parseObject, parseObjectField, parseList, parseSelectionSet, parseSelection, parseField, parseTypeReference, parseInlineFragment). Each PHP call frame consumes approximately 256 bytes of C stack; at 26,000–87,500 levels of nesting (depending on the attack vector), the cumulative stack usage crosses the 8 MB guard page, causing the kernel to deliver SIGSEGV (signal 11) to the PHP process. Critically, this crash occurs before any GraphQL validation, complexity analysis, or persisted-query allow-list checks run, and PHP's zend.max_allowed_stack_size (introduced in PHP 8.3) does not prevent the segfault in practice — every tested configuration produces exit code 139. Four distinct attack vectors exist: nested object values ({a:{a:..}}), nested selection sets ({a{a{..}}}), nested list values ([[..1..]], smallest payload ~74 KB), and nested list types ([[Int]]) (GitHub Advisory, Patch Commit).

Successful exploitation terminates the PHP process handling the malicious request via SIGSEGV, with no catchable exception, no PHP error log entry, and no graceful shutdown. In PHP-FPM deployments, the FPM master kills and respawns the worker, dropping all concurrent in-flight requests on that worker. In long-running runtimes (Swoole, RoadRunner, ReactPHP), the entire daemon process is killed. The attack has no confidentiality impact, a low integrity impact (due to dropped concurrent requests), and high availability impact. The minimum crashing payload (~74 KB) is well below common HTTP body size limits and is highly compressible (gzip reduces it to a few hundred bytes), enabling bypass of WAF body-size inspection. The library is used by Lighthouse (Laravel), Overblog/GraphQLBundle (Symfony), wp-graphql (WordPress), and the Drupal GraphQL module, giving this vulnerability broad ecosystem reach (GitHub Advisory).

A public proof-of-concept (PoC) PHP script is available in the GitHub Security Advisory, which demonstrates all four attack vectors and confirms SIGSEGV termination (exit code 139) against webonyx/graphql-php v15.31.4 on PHP 8.3.30. The vulnerability requires no authentication, no user interaction, and is network-exploitable with low attack complexity, making it fully automatable. There is no evidence of in-the-wild exploitation at this time, and it is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0045 (0.45%), reflecting low but non-zero exploitation probability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify PHP applications exposing a GraphQL endpoint (HTTP POST accepting application/graphql or application/json) that use webonyx/graphql-php prior to version 15.32.3. Frameworks to target include Laravel (Lighthouse), Symfony (Overblog/GraphQLBundle), WordPress (wp-graphql), and Drupal (GraphQL module).
2. Craft the payload: Generate a deeply nested GraphQL query using one of four vectors. The smallest reliable crashing payload is Vector C (nested list values): construct a query string with str_repeat('[', 37500) . '1' . str_repeat(']', 37500) (~74 KB uncompressed). Alternatively, use Vector A (nested object values) or Vector B (nested selection sets) at depth ~26,250, or Vector D (nested list types) at depth ~87,500.
3. Optionally compress the payload: Gzip-compress the 74 KB payload to a few hundred bytes to bypass HTTP body size limits (nginx client_max_body_size, AWS ALB caps) and WAF inspection of the encoded form.
4. Send the HTTP POST request: Submit the crafted query as the body of an HTTP POST to the GraphQL endpoint (e.g., /graphql). No authentication headers are required.
5. Parser enters unbounded recursion: The application calls Parser::parse($q). The parser's recursive methods (parseValueLiteral → parseList → parseValueLiteral for Vector C) call themselves without any depth check, consuming ~256 bytes of C stack per frame.
6. Stack exhaustion triggers SIGSEGV: At ~37,500 recursive calls, the C stack pointer crosses the guard page. The kernel delivers SIGSEGV (signal 11) to the PHP process, terminating it with exit code 139 before any GraphQL validation runs.
7. Observe impact: In PHP-FPM, the FPM master logs WARNING: [pool www] child <PID> exited on signal 11 (SIGSEGV) and respawns the worker, dropping all concurrent requests. In Swoole/RoadRunner/ReactPHP, the entire daemon terminates. No PHP-level error or stack trace is produced (GitHub Advisory, Feedly).

• Logs (PHP-FPM): WARNING: [pool www] child <PID> exited on signal 11 (SIGSEGV) in the FPM master log (/var/log/php-fpm/error.log or equivalent); repeated worker respawn events in a short time window.
• Logs (System): Kernel messages (dmesg) showing segfault entries for the PHP process, e.g., php-fpm[<PID>]: segfault at ... error 6 in ....
• Network: HTTP POST requests to the GraphQL endpoint (e.g., /graphql) with unusually large bodies (~74 KB or larger) or with Content-Encoding: gzip and a small encoded body that decompresses to a deeply nested structure; repeated POST requests from the same source IP resulting in 502/504 responses.
• Process: Abnormal PHP-FPM worker churn — workers being killed and respawned at an elevated rate; Swoole, RoadRunner, or ReactPHP daemon processes exiting unexpectedly with exit code 139.
• Application: Sudden increase in dropped or unanswered concurrent requests coinciding with specific POST requests to the GraphQL endpoint; absence of any PHP application-level error log entries despite process termination (GitHub Advisory).

Primary remediation: Upgrade webonyx/graphql-php to version 15.32.3 or later via Composer (composer require webonyx/graphql-php:^15.32.3). The fix adds a shared recursionDepth counter and recursionLimit option (default: 256) to parseSelectionSet, parseValueLiteral, and parseTypeReference; exceeding the limit throws a catchable SyntaxError before the stack overflows (Release v15.32.3, Patch Commit).

Configuration workarounds (if immediate upgrade is not possible):

• Configure a reverse proxy (nginx, AWS ALB) to reject uncompressed request bodies above a safe threshold (e.g., 50 KB) before they reach the PHP process.
• Implement network-level rate limiting on the GraphQL endpoint to reduce the rate of potential abuse.
• Use a WAF rule to inspect decompressed request bodies for deeply nested bracket patterns.
• Note: zend.max_allowed_stack_size (PHP 8.3) does not prevent this crash and should not be relied upon as a mitigation (GitHub Advisory).

The advisory was authored and published by spawnia (the primary maintainer of webonyx/graphql-php) on April 24, 2026, with the fix released the same day. The advisory credits researchers d0cs1s-bzhunt and BZHunt as reporters. The advisory explicitly notes that the recursive descent design has been unchanged since the parser was rewritten in v15.x, and that no parser-side resource limits of any kind existed prior to this fix — a finding the advisory characterizes as a defense-in-depth gap. The broad ecosystem impact (Lighthouse, Overblog/GraphQLBundle, wp-graphql, Drupal GraphQL) was highlighted as a significant concern given the library's role as the de facto PHP GraphQL parser (GitHub Advisory).