CVE-2026-107727: CWE-400: Uncontrolled Resource Consumption in strawberry-graphql strawberry
Description
CVE-2026-107727 is a low severity vulnerability in the strawberry-graphql library affecting versions from 0.312.3 up to but not including 0.327.2. The legacy graphql-ws subscription handler does not properly remove completed operations from internal tracking structures, allowing a client to exhaust the configured subscription slots on a persistent WebSocket connection. This results in legitimate subscription requests being rejected due to reaching the subscription limit. The issue does not affect the modern graphql-transport-ws protocol or deployments without a per-connection subscription cap. The vulnerability is fixed in version 0.327.2.
CVSS v3.1
Score 3.7low
Affected software
strawberry-graphql
strawberry
pkg:pypi/strawberry-graphql/strawberryRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Strawberry GraphQL versions >=0.312.3 and <0.327.2 contain a resource consumption vulnerability (CWE-400) in the legacy graphql-ws subscription handler. Completed subscription operations are not removed from the self.tasks and self.subscriptions collections, causing these to accumulate when max_subscriptions_per_connection is configured. A client can exploit this by issuing multiple one-shot subscriptions with distinct operation IDs on a persistent WebSocket connection, filling all allowed subscription slots even after completion. This prevents new legitimate subscriptions from being accepted. The modern graphql-transport-ws protocol and configurations without subscription limits are unaffected. The vulnerability is resolved in version 0.327.2.
Potential Impact
An attacker with network access to a persistent WebSocket connection can cause denial of service for legitimate subscription operations by exhausting the allowed subscription slots. This leads to rejection of new subscription requests on that connection. The impact is limited to availability degradation (low severity) and does not affect confidentiality or integrity.
Mitigation Recommendations
Upgrade strawberry-graphql to version 0.327.2 or later where this issue is fixed. If upgrading is not immediately possible, consider disabling the legacy graphql-ws subscription handler or avoid configuring max_subscriptions_per_connection until a patch is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-08T17:21:52.976Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac81a5e2cdf04f6563e4cf8
Added to database: 10/08/2026, 22:34:06 UTC
Last enriched: 10/08/2026, 22:49:13 UTC
Last updated: 10/08/2026, 22:49:13 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.