PYSEC-2026-2282

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Summary The MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this...

GHSA-FR49-MHGJ-CRFC Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Summary The MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this...

aas2openapi (>=0.2.0, <=0.2.4), alchemy-graph (>=0.1.1, <=0.1.2) +65 more potentially affected by CVE-2026-47707 via strawberry-graphql (>=0.174.0, <=0.315.2)

strawberry-graphql PYPI version =0.174.0, =0.2.0, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.20rc0, =25.13.0rc1, =1.2.0, =0.4.0, =1.1.20, =0.1.2, =0.1.3.60 and more Source cves: CVE-2026-47707 Source advisory: GHSA-FR49-MHGJ-CRFC...

aas2openapi (>=0.2.0, <=0.2.4), alchemy-graph (>=0.1.1, <=0.1.2) +65 more potentially affected by CVE-2026-47707 via strawberry-graphql (>=0.174.0, <=0.315.2)

strawberry-graphql PYPI version =0.174.0, =0.2.0, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.20rc0, =25.13.0rc1, =1.2.0, =0.4.0, =1.1.20, =0.1.2, =0.1.3.60 and more Source cves: CVE-2026-47707 Source advisory: OSV:GHSA-FR49-MHGJ-CRFC...

Strawberry GraphQL has a Circular Fragment Reference DOS

Summary The QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth function enters an infinite recursion, leading to a RecursionError and crashing the...

GHSA-QFWV-87QJ-98XQ Strawberry GraphQL has a Circular Fragment Reference DOS

Summary The QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth function enters an infinite recursion, leading to a RecursionError and crashing the...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +82 more potentially affected by CVE-2026-47706 via strawberry-graphql (>=0.73.9, <=0.315.2)

strawberry-graphql PYPI version =0.73.9, =0.2.0, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.9.0, =0.9.1 and more Source cves: CVE-2026-47706 Source advisory: GHSA-QFWV-87QJ-98XQ...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +82 more potentially affected by CVE-2026-47706 via strawberry-graphql (>=0.73.9, <=0.315.2)

strawberry-graphql PYPI version =0.73.9, =0.2.0, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.9.0, =0.9.1 and more Source cves: CVE-2026-47706 Source advisory: OSV:GHSA-QFWV-87QJ-98XQ...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +82 more potentially affected by CVE-2026-47706 via strawberry-graphql (>=0.73.9, <=0.315.2)

strawberry-graphql PYPI version =0.73.9, =0.2.0, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.9.0, =0.9.1 and more Source cves: CVE-2026-47706 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-17173220...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the GraphQL API Endpoint that lacks depth limiting and complexity analysis for SQL queries. An attacker can cause excessive resource consumption by sending specially crafted reques...

CVE-2026-47707 Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

CVE-2026-47707

Technical details about CVE-2026-47707 are not publicly available in the provided documents; monitor vendor advisories and official releases for updates.

CVE-2026-47707 Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

CVE-2026-47707

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

EUVD-2026-34271

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

CVE-2026-47707 Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

CVE-2026-47707

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

aas2openapi (>=0.2.0, <=0.2.4), alchemy-graph (>=0.1.1, <=0.1.2) +65 more potentially affected by CVE-2026-47707 via strawberry-graphql (>=0.174.0, <=0.315.2)

strawberry-graphql PYPI version =0.174.0, =0.2.0, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.20rc0, =25.13.0rc1, =1.2.0, =0.4.0, =1.1.20, =0.1.2, =0.1.3.60 and more Source cves: CVE-2026-47707 Source advisory: MEND:CVE-2026-47707...

CVE-2026-45739 Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...