AIKIDO-2026-10553

TL;DR

The OverlappingFieldsCanBeMerged validation rule compares candidate fields for merge conflicts. When a query uses many nested inline fragments that project the same response name, the work in the conflict routine can grow far faster than linearly because inline fragments are not covered by the same memoization that applies to named fragments, so the validator can spend a long time in pure CPU on a small document. A shared comparison counter now increments across the recursive checks and returns a validation error when a configurable limit is exceeded, with a large default, so a single request cannot drive unbounded comparison work in that rule. Typical depth and per-query complexity limits do not catch this pattern because the cost sits in this merge pass before execution.