EUVD-2026-34269
GHSA-qfwv-87qj-98xq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.
AnalysisAI
Infinite recursion in Strawberry GraphQL's QueryDepthLimiter extension allows unauthenticated remote attackers to crash the validation process and exhaust server resources by submitting queries with circular fragment references. Affected versions 0.71.0 through 0.315.6 of the pip package strawberry-graphql fail to track visited fragments in the determine_depth function, meaning a trivially crafted two-fragment cycle (A spreads B, B spreads A) triggers a Python RecursionError before any query execution occurs. A public proof-of-concept is confirmed in GHSA-qfwv-87qj-98xq; no active exploitation is listed in CISA KEV at time of analysis.
Technical ContextAI
Strawberry GraphQL (CPE: cpe:2.3:a:strawberry-graphql:strawberry:*) is a Python library that builds GraphQL APIs using type annotations. GraphQL's fragment spread mechanism allows reusable field selection sets; the QueryDepthLimiter extension validates that query depth does not exceed a configured maximum by recursively resolving these fragment references via the determine_depth function in query_depth_limiter.py. CWE-400 (Uncontrolled Resource Consumption) is the root cause: the recursive resolver carries no visited-fragment set, so a graph containing a cycle between two FragmentSpreadNode references causes unbounded stack growth. Because GraphQL validation is a pre-execution phase, the crash is triggered without any schema logic running, making it fully accessible at the protocol boundary. The release notes confirm the fix also addresses a related fragment-expansion flaw in MaxAliasesLimiter (GHSA-fr49-mhgj-crfc), suggesting the same architectural oversight existed in both extensions.
RemediationAI
Upgrade strawberry-graphql to version 0.315.7 or later, which introduces visited-fragment tracking in determine_depth to break circular reference cycles; this release also simultaneously fixes the related MaxAliasesLimiter alias-counting flaw (GHSA-fr49-mhgj-crfc). See the release at https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7 and the fix PR #4421. For deployments that cannot immediately upgrade, removing the QueryDepthLimiter extension from the schema eliminates the vulnerable code path entirely, though this trades away query depth enforcement as a defensive control - weigh this trade-off against exposure risk. An alternative compensating control is to place a GraphQL-aware proxy or WAF upstream that rejects queries containing fragment spread cycles before they reach Strawberry's validation layer; this requires the proxy to implement its own cycle detection and adds latency. Generic query size or complexity limits at the HTTP layer (e.g., rejecting requests above a payload byte threshold) can reduce but not eliminate the attack surface, as the malicious payload is small.
More in Strawberry
View allDenial-of-service via alias amplification in Strawberry GraphQL (versions 0.172.0 through 0.315.6) allows unauthenticate
Strawberry GraphQL is a library for creating GraphQL APIs. Rated high severity (CVSS 8.0), this vulnerability is remotel
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today