Strawberry GraphQL's WebSocket subscription handlers for both graphql-transport-ws and legacy graphql-ws protocols create an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing limits on active subscriptions per connection. An unauthenticated attacker can exploit this by opening a single WebSocket connection and sending numerous subscribe messages with unique IDs, causing unbounded resource allocation. This results in linear memory consumption and event loop saturation, degrading server performance or causing an out-of-memory crash. The vulnerability is addressed in Strawberry GraphQL version 0.312.3.

An unauthenticated attacker can cause denial of service by exhausting server resources through unlimited subscription requests over a single WebSocket connection. This leads to server degradation or crashes due to out-of-memory conditions. There is no impact on confidentiality or integrity reported.

Upgrade Strawberry GraphQL to version 0.312.3 or later, where this vulnerability is fixed. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue is resolved in 0.312.3. Until upgraded, consider implementing external rate limiting or connection throttling at the network or application gateway level to mitigate resource exhaustion.