GitHub Advisoryadvisory · RubyGems

GHSA-3h96-34p3-xm76 GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

MEDIUM Published 2026-05-05 Modified 2026-05-05 Official page ↗
Ecosystem
RubyGems
Packages
graphql
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-770
Reviewed
2026-05-05

Affected packages

• RubyGems graphql: >= 2.6.0, < 2.6.1 → fixed in 2.6.1 • RubyGems graphql: >= 2.5.0, < 2.5.26 → fixed in 2.5.26 • RubyGems graphql: >= 2.4.0, < 2.4.18 → fixed in 2.4.18 • RubyGems graphql: >= 2.3.1, < 2.3.23 → fixed in 2.3.23

Description

GraphQL-Ruby's `max_query_string_tokens` configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this problem. `max_query_string_tokens` was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References