Threats affecting pkg:pypi/strawberry-graphql/strawberry

CVE-2026-107728 is an incorrect authorization vulnerability in the strawberry-graphql library affecting versions from 0.217.0 up to but not including 0.326.1. The flaw occurs when a synchronous field resolver uses a custom permission whose has_permission() method is defined as a normal function returning an awaitable object. Because the awaitable is not awaited, its inherently truthy value incorrectly allows access to protected resolvers even when permission should be denied. This issue does not affect async has_permission() methods or synchronous permissions returning booleans. The vulnerability is fixed in version 0.326.1.

A resource consumption vulnerability exists in the legacy graphql-ws subscription handler of strawberry-graphql versions from 0.312.3 up to but not including 0.327.2. Completed subscription operations are not removed from internal tracking structures, allowing a client to exhaust the configured subscription slots on a persistent WebSocket connection. This causes legitimate new subscriptions to be rejected due to reaching the subscription limit. The issue does not affect the modern graphql-transport-ws protocol or deployments without per-connection subscription caps. The vulnerability is fixed in version 0.327.2.

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion. Version 0.315.7 contains a fix for the issue.

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as `Authorization: Bearer <token>`, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request. Version 0.315.4 patches the issue.

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.

CVE-2026-35526 is a high-severity vulnerability in Strawberry GraphQL versions prior to 0.312.3. The issue arises from the WebSocket subscription handlers, which allocate resources without limiting the number of active subscriptions per connection. An unauthenticated attacker can exploit this by opening a WebSocket connection and flooding subscribe messages, causing unbounded resource consumption. This leads to server degradation or an out-of-memory (OOM) crash. The vulnerability is fixed in version 0.312.3.