PT-2026-46250 · Unknown · Strawberry Graphql

Gonas0919 · CVE-2026-47707 · Published 2026-06-04 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.172.0 through 0.315.6

Description The MaxAliasesLimiter extension fails to account for the multiplicative effect of FragmentSpreadNode. While static aliases within the Abstract Syntax Tree (AST) are counted, the system does not consider how many times internal aliases of a fragment are expanded during execution. This allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than permitted, potentially leading to a denial of service (DoS) via resource exhaustion of CPU and memory.

Recommendations Update to version 0.315.7.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-47707

GHSA-FR49-MHGJ-CRFC

PYSEC-2026-2284

Affected Products

Strawberry Graphql

References · 10

• 🔥 https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47707.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47707 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-47707 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fr49-mhgj-crfc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47707 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2284 · Vendor Advisory
• https://github.com/strawberry-graphql/strawberry · Note
• https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7 · Note
• https://twitter.com/VulmonFeeds/status/2062566382814785882 · Twitter Post