TI-2026-35210 CVE-2026-47707 · GHSA-fr49-mhgj-crfc
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Priority MEDIUM 63
Strawberry GraphQL is a library for creating GraphQL APIs.
strawberry-graphql
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
strawberry-graphql records in CISA KEVNo strawberry-graphql vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Strawberry Graphql · all components
TI-2026-35209 CVE-2026-47706 · GHSA-qfwv-87qj-98xq
Strawberry GraphQL has a Circular Fragment Reference DOS
Priority MEDIUM 63
Strawberry GraphQL is a library for creating GraphQL APIs.
TI-2026-27641 CVE-2026-35526 · GHSA-hv3w-m4g2-5x77
Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions
Priority LOW 39
Strawberry GraphQL is a library for creating GraphQL APIs.
TI-2026-27639 CVE-2026-35523 · GHSA-vpwc-v33q-mq89
Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol
Priority LOW 39
Strawberry GraphQL is a library for creating GraphQL APIs.
TI-2026-33476 CVE-2026-45739 · GHSA-x97m-qp5c-w9xj
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
Priority LOW 19
Strawberry GraphQL is a library for creating GraphQL APIs.