Strawberry Graphql
Approved changes feed: RSS · Atom
cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:*part: a version: * update: *
| Vendor | Strawberry (f0babf07-9c8f-5aac-82f8-094b3c72c58d) |
|---|---|
| Product | Strawberry Graphql (ae6acb60-ddc3-5028-8a6f-b9da7e3529b9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | python |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-35526 |
vulnerable | 2026-06-08 07:59:14.079049 |
Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions
HIGH (7.5)
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3.
Published: 2026-04-07T15:23:36.548Z
Updated: 2026-04-08T14:55:58.026Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35523 |
vulnerable | 2026-06-08 07:59:14.078271 |
Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol
HIGH (7.5)
Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init handshake has been completed before processing start (subscription) messages. This allows a remote attacker to skip the on_ws_connect authentication hook entirely by connecting with the graphql-ws subprotocol and sending a start message directly, without ever sending connection_init. This vulnerability is fixed in 0.312.3.
Published: 2026-04-07T15:58:17.694Z
Updated: 2026-04-09T16:18:51.112Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.