Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| strawberry-graphql | strawberry | before 0.312.3 | 0.312.3 | Patch available | CNA |
| — | strawberry-graphql (PyPI) | before 0.312.3 | 0.312.3 | Patch available | GHSA-hv3w-m4g2-5x77 |
- strawberry Vendorstrawberry-graphql Affected before 0.312.3 Fixed in 0.312.3 Patch available CNA
- strawberry-graphql (PyPI) Vendor— Affected before 0.312.3 Fixed in 0.312.3 Patch available GHSA-hv3w-m4g2-5x77
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:* | before 0.312.3 | Vulnerable | strawberry-graphql |
- cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:* Versions before 0.312.3 Vulnerable ·strawberry-graphql
Remediation
- Fix · CNA strawberry (strawberry-graphql) Fixed in 0.312.3
- Fix · GHSA-hv3w-m4g2-5x77 strawberry-graphql (PyPI) Fixed in 0.312.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-35526
- 2026-10-03 Alias added: GHSA-hv3w-m4g2-5x77
References
Advisory 2
Other 4
- https://github.com/strawberry-graphql/strawberry/commit/0977a4e6b41b7cfe3e9d8ba84a43458a2b0c54c2
- https://github.com/pypa/advisory-database/tree/main/vulns/strawberry-graphql/PYSEC-2026-134.yaml
- https://github.com/strawberry-graphql/strawberry
- https://github.com/strawberry-graphql/strawberry/releases/tag/0.312.3
More strawberry-graphql Strawberry Graphql vulnerabilities
- TI-2026-35210 Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification CVSS 3.1MEDIUM 5.3
- TI-2026-35209 Strawberry GraphQL has a Circular Fragment Reference DOS CVSS 3.1MEDIUM 5.3
- TI-2026-27639 Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol CVSS 3.1HIGH 7.5
- TI-2026-33476 Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-35526 · CVE Program
- CVE-2026-35526 · NVD
- FIRST EPSS
- GHSA-hv3w-m4g2-5x77 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences