GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens
Published: May 05, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-3h96-34p3-xm76
- Vendor Advisory: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76
GEM
SEVERITY
CVSS v3.x: 5.3 (Medium)
UNAFFECTED VERSIONS
< 2.3.1
PATCHED VERSIONS
~> 2.3.23
~> 2.4.18
~> 2.5.26
>= 2.6.1
DESCRIPTION
GraphQL-Ruby's max_query_string_tokens configuration didn't count
comment tokens against the limit, allowing strings to be processed
even after the configured maximum had actually been reached.
In patched versions, the Ruby lexer does count these tokens.
GraphQL-CParser is not affected by this problem.
max_query_string_tokens was introduced in v2.3.1. Each 2.x
version has received a new patch release for including a fix.
RELATED
- https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#261
- https://github.com/rmosolgo/graphql-ruby/commit/2a8d95680bf1ed9bb7c0d89345a736f57b10877b
- https://github.com/rmosolgo/graphql-ruby/pull/4929
- https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76
- https://github.com/advisories/GHSA-3h96-34p3-xm76