CVE-2026-107727lowCWE-400

CVE-2026-107727: falha de baixa gravidade em strawberry-graphql strawberry

Strawberry legacy graphql-ws retains naturally completed subscription slots

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar strawberry+ Monitorar strawberry-graphql

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.7epss 0.4%
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
strawberry-graphql · strawberry
CVEs relacionadas — strawberry-graphql strawberry

No mesmo produto, das mais perigosas para as menos.

CVE-2026-47707MEDIUMStrawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias AmplificationEPSS 0.5%CVE-2026-107728HIGHStrawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthyEPSS 0.4%CVE-2026-35523HIGHAuthentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocolEPSS 0.4%CVE-2025-22151LOWStrawberry GraphQL has a type resolution vulnerabilityEPSS 0.4%CVE-2026-47706MEDIUMStrawberry GraphQL has a Circular Fragment Reference DOSEPSS 0.3%CVE-2026-35526HIGHStrawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptionsEPSS 0.3%