CVE-2026-107727
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Strawberry GraphQL versions 0.312.3 through 0.327.2 do not remove completed operations from task and subscription lists in the legacy graphql-ws handler. With a configured per-connection subscription limit, a client can exhaust the limit, blocking later legitimate operations. Fixed in version 0.327.2.
Risk Assessment
An attacker can cause denial of service for other users on the same WebSocket connection, preventing them from performing subscriptions.
Recommendation
Upgrade Strawberry GraphQL to version 0.327.2 or later. If upgrade is not possible, consider disabling the per-connection subscription limit or migrating to the modern graphql-transport-ws protocol.
Other vulnerabilities in Strawberry GraphQL
See all- CVE-2026-107728High
Strawberry GraphQL from 0.217.0 until 0.326.1 has a vulnerability where PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync does not classify it as asynchronous, the awaitable is not awaited, and its inherently truthy object value permits the protected resolver to run even when the result would resolve to false.
- CVE-2026-47707Medium
Strawberry GraphQL versions 0.172.0 through 0.315.6 incorrectly count aliases when expanding FragmentSpreadNode. An attacker can bypass alias limits and force the server to resolve a significantly higher number of aliases than allowed, leading to resource exhaustion and denial of service (DoS).
- CVE-2026-47706Medium
Strawberry GraphQL versions 0.71.0 through 0.315.6 are vulnerable to a DoS attack in the QueryDepthLimiter extension. Lack of cycle detection in fragment spreads causes infinite recursion and a RecursionError. Fixed in version 0.315.7.
- CVE-2026-45739Low
In Strawberry GraphQL versions 0.288.4 through 0.315.3, the bundled GraphiQL template wrote header editor values into the browser URL query string. This could expose sensitive headers like authorization tokens.
Original NVD description (English source)
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS