CVE-2026-47706
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Strawberry GraphQL versions 0.71.0 through 0.315.6 are vulnerable to a DoS attack in the QueryDepthLimiter extension. Lack of cycle detection in fragment spreads causes infinite recursion and a RecursionError. Fixed in version 0.315.7.
Risk Assessment
An attacker can remotely crash the query validation process, leading to service disruption (DoS).
Recommendation
Update Strawberry GraphQL to version 0.315.7 or later.
Other vulnerabilities in Strawberry GraphQL
See all- CVE-2026-47707Medium
Strawberry GraphQL versions 0.172.0 through 0.315.6 incorrectly count aliases when expanding FragmentSpreadNode. An attacker can bypass alias limits and force the server to resolve a significantly higher number of aliases than allowed, leading to resource exhaustion and denial of service (DoS).
- CVE-2026-45739Low
In Strawberry GraphQL versions 0.288.4 through 0.315.3, the bundled GraphiQL template wrote header editor values into the browser URL query string. This could expose sensitive headers like authorization tokens.
Original NVD description (English source)
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.