PT-2026-30762 · Unknown · Strawberry Graphql
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Strawberry GraphQL versions prior to 0.312.3
Description
Strawberry GraphQL WebSocket subscription handlers for both the
graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without limiting the number of active subscriptions per connection. An unauthenticated attacker can open a WebSocket connection, send a connection init message, and flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, leading to linear memory growth and event loop saturation, potentially causing server degradation or an out-of-memory (OOM) crash.Recommendations
Update to Strawberry GraphQL version 0.312.3 or later.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Strawberry Graphql