Strawberry GraphQL's WebSocket subscription handlers for both graphql-transport-ws and legacy graphql-ws protocols create an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing limits on active subscriptions per connection. This lack of throttling allows an unauthenticated attacker to open a single WebSocket connection, send a connection_init message, and flood the server with subscribe messages containing unique IDs. Each subscribe message spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation, which can degrade server performance or cause an OOM crash. The vulnerability is addressed in Strawberry GraphQL version 0.312.3.

The vulnerability allows unauthenticated attackers to cause denial of service by exhausting server resources through unbounded subscription requests over a single WebSocket connection. This results in server degradation or crashes due to out-of-memory conditions. There is no impact on confidentiality or integrity reported.

A fix is available in Strawberry GraphQL version 0.312.3. Users should upgrade to this version or later to remediate the vulnerability. No other official mitigation or temporary workaround is documented. Patch status is confirmed by the vendor advisory stating the issue is fixed in 0.312.3.