EUVD-2026-34271
GHSA-fr49-mhgj-crfc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion. Version 0.315.7 contains a fix for the issue.
AnalysisAI
Denial-of-service via alias amplification in Strawberry GraphQL (versions 0.172.0 through 0.315.6) allows unauthenticated remote attackers to exhaust server resources by bypassing the MaxAliasesLimiter extension using crafted GraphQL fragment spreads. The limiter performs only a static AST alias count, missing the multiplicative expansion that occurs at execution time when a fragment containing N aliases is spread M times - producing N×M resolved aliases against a limit enforced at N+M. A publicly available proof-of-concept exists demonstrating the bypass; no active exploitation has been confirmed in CISA KEV at time of analysis.
Technical ContextAI
Strawberry GraphQL (CPE: cpe:2.3:a:strawberry-graphql:strawberry:*:*:*:*:*:*:*:*) is a Python library for building GraphQL APIs, commonly integrated with FastAPI or Django. The MaxAliasesLimiter extension in strawberry/extensions/max_aliases.py is a denial-of-service guard that caps the number of field aliases a query may declare. The root cause (CWE-400: Uncontrolled Resource Consumption) is a logic flaw: alias counting traverses FieldNode and InlineFragmentNode selections statically but does not recurse into or multiply aliases found inside FragmentSpreadNode references. Since GraphQL execution expands each fragment spread independently at runtime, a fragment with 10 aliases spread 10 times resolves 100 aliases against a limit that only sees 10. The fix in 0.315.7 corrects both MaxAliasesLimiter and QueryDepthLimiter to expand fragment spreads during counting.
RemediationAI
Upgrade to Strawberry GraphQL version 0.315.7, which expands fragment spreads when counting aliases and correctly enforces the configured alias limit at execution-time multiplicity. The release is available at https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7 and was contributed via pull request #4421. If an immediate upgrade is not feasible, a compensating control is to restrict GraphQL query complexity at the network or application layer - for example, by limiting maximum query body size via web server or API gateway configuration, or by disabling anonymous/unauthenticated access to the GraphQL endpoint to reduce attacker surface. Neither workaround fully mitigates the amplification flaw; authenticated-only access meaningfully reduces risk for internal APIs but does not fix the underlying bypass for any environment where credentials are obtainable. The 0.315.7 release also fixes a related circular-fragment recursion issue in QueryDepthLimiter (GHSA-qfwv-87qj-98xq), making the upgrade doubly beneficial.
More in Strawberry
View allInfinite recursion in Strawberry GraphQL's QueryDepthLimiter extension allows unauthenticated remote attackers to crash
Strawberry GraphQL is a library for creating GraphQL APIs. Rated high severity (CVSS 8.0), this vulnerability is remotel
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today