EUVD-2026-34269
GHSA-qfwv-87qj-98xq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
3DescriptionGitHub Advisory
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.
AnalysisAI
Infinite recursion in Strawberry GraphQL's QueryDepthLimiter extension allows unauthenticated remote attackers to crash the validation process and exhaust server resources by submitting queries with circular fragment references. Affected versions 0.71.0 through 0.315.6 of the pip package strawberry-graphql fail to track visited fragments in the determine_depth function, meaning a trivially crafted two-fragment cycle (A spreads B, B spreads A) triggers a Python RecursionError before any query execution occurs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Strawberry GraphQL application to have explicitly configured the QueryDepthLimiter extension in its schema definition (e.g., extensions=[QueryDepthLimiter(max_depth=N)]). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.3 Medium with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately reflects the attack profile - network-reachable, no authentication, no user interaction - but the Availability:Low rating understates operational impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a single HTTP POST to the target's /graphql endpoint containing a query that defines two fragments mutually referencing each other - Fragment A spreading Fragment B and Fragment B spreading Fragment A - then invokes one of them in the operation body. The QueryDepthLimiter validation phase immediately enters infinite recursion, raises a Python RecursionError, and crashes the request handler. … |
| Remediation | Upgrade strawberry-graphql to version 0.315.7 or later, which introduces visited-fragment tracking in determine_depth to break circular reference cycles; this release also simultaneously fixes the related MaxAliasesLimiter alias-counting flaw (GHSA-fr49-mhgj-crfc). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today