CVE-2026-47707
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Strawberry GraphQL versions 0.172.0 through 0.315.6 incorrectly count aliases when expanding FragmentSpreadNode. An attacker can bypass alias limits and force the server to resolve a significantly higher number of aliases than allowed, leading to resource exhaustion and denial of service (DoS).
Risk Assessment
The risk is a potential DoS attack by sending a crafted GraphQL query that uses fragments to amplify the number of aliases, potentially overloading the server.
Recommendation
Immediately upgrade Strawberry GraphQL to version 0.315.7 or later, which contains the fix.
Other vulnerabilities in Strawberry GraphQL
See all- CVE-2026-47706Medium
Strawberry GraphQL versions 0.71.0 through 0.315.6 are vulnerable to a DoS attack in the QueryDepthLimiter extension. Lack of cycle detection in fragment spreads causes infinite recursion and a RecursionError. Fixed in version 0.315.7.
- CVE-2026-45739Low
In Strawberry GraphQL versions 0.288.4 through 0.315.3, the bundled GraphiQL template wrote header editor values into the browser URL query string. This could expose sensitive headers like authorization tokens.
Original NVD description (English source)
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion. Version 0.315.7 contains a fix for the issue.