PT-2026-30762 · Unknown · Strawberry Graphql

Jfoz1010 · Published 2026-04-06 · Updated 2026-06-05 · CVE-2026-35526

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions prior to 0.312.3

Description Strawberry GraphQL WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without limiting the number of active subscriptions per connection. An unauthenticated attacker can open a WebSocket connection, send a connection init message, and flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, leading to linear memory growth and event loop saturation, potentially causing server degradation or an out-of-memory (OOM) crash.

Recommendations Update to Strawberry GraphQL version 0.312.3 or later.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-35526

GHSA-HV3W-M4G2-5X77

PYSEC-2026-134

Affected Products

Strawberry Graphql

References · 11

• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hv3w-m4g2-5x77 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-35526 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35526 · Security Note
• https://github.com/strawberry-graphql/strawberry · Note
• https://github.com/strawberry-graphql/strawberry/commit/0977a4e6b41b7cfe3e9d8ba84a43458a2b0c54c2 · Note
• https://github.com/strawberry-graphql/strawberry/releases/tag/0.312.3 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/strawberry-graphql/PYSEC-2026-134.yaml · Note
• https://twitter.com/VulmonFeeds/status/2041604208051323190 · Twitter Post
• https://twitter.com/CVEnew/status/2041603202844332151 · Twitter Post