Strawberry GraphQL
CVE-2026-107727
LOW
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
AC:H because exploitation depends on the non-default max_subscriptions_per_connection cap plus the legacy protocol; PR:N as an open subscription endpoint needs no auth; A:L only, self-scoped to the attacker's connection.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2.
AnalysisAI
Uncontrolled resource consumption in the Strawberry GraphQL library's legacy graphql-ws subscription handler (versions 0.312.3 up to but not including 0.327.2) allows an unauthenticated remote client on a persistent WebSocket connection to fill that connection's configured subscription slots with one-shot subscriptions that have already completed, so later legitimate operations on the same connection are rejected with 'Subscription limit reached'. The impact is limited to the attacker's own connection and to availability (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), requiring the non-default max_subscriptions_per_connection cap to be explicitly configured and the legacy graphql-ws protocol to be in use; the modern graphql-transport-ws protocol and deployments without the cap are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete, concurrent conditions: (1) the server must use the LEGACY graphql-ws subscription protocol handler (strawberry/subscriptions/protocols/graphql_ws/handlers.py) - the modern graphql-transport-ws protocol is explicitly unaffected; (2) the server must have max_subscriptions_per_connection explicitly configured (a non-default per-connection cap) - deployments without this cap are not affected; and (3) the Strawberry version must be in range 0.312.3 up to but not including 0.327.2. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite being network-reachable and unauthenticated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Strawberry GraphQL 0.327.2 or later, which is the version that fixes this issue (release tag https://github.com/strawberry-graphql/strawberry/releases/tag/0.327.2, advisory GHSA-m952-2w3f-6r8h, fixing commit 24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92 from PR 4610); the patch releases bookkeeping slots in a finally block as operations finish naturally or fail before execution, and also makes a 'stop' for an already-completed operation a harmless no-op. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Strawberry
View allDenial-of-service via alias amplification in Strawberry GraphQL (versions 0.172.0 through 0.315.6) allows unauthenticate
Infinite recursion in Strawberry GraphQL's QueryDepthLimiter extension allows unauthenticated remote attackers to crash
Strawberry GraphQL is a library for creating GraphQL APIs. Rated high severity (CVSS 8.0), this vulnerability is remotel
Strawberry GraphQL versions 0.217.0 through 0.326.0 contain an authorization bypass in which a custom permission class w
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today