aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +82 more potentially affected by CVE-2026-47706 via strawberry-graphql (>=0.73.9, <=0.315.2)

strawberry-graphql PYPI version =0.73.9, =0.2.0, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.9.0, =0.9.1 and more Source cves: CVE-2026-47706 Source advisory: MEND:CVE-2026-47706...

CVE-2026-47706 Strawberry GraphQL has a Circular Fragment Reference DOS

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...

bocadillo (>=0.12.3, <=0.14.2), starlette-jsonrpc (>=0.1.0, <=0.2.0) +2 more potentially affected by CVE-2026-48710 via starlette (0.11.4)

starlette PYPI version 0.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bocadillo =0.12.3, =0.1.0, =0.1.0, =0.11.0 - termpair 0.0.0.2 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-48710 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

strawberry-graphql (>=0.13.0, <=0.13.1) potentially affected by CVE-2026-48710 via starlette (0.12.1)

starlette PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - strawberry-graphql =0.13.0, =0.13.1 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

strawberry-graphql (>=0.13.2, <=0.13.4) potentially affected by CVE-2026-48710 via starlette (0.12.4)

starlette PYPI version 0.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - strawberry-graphql =0.13.2, =0.13.4 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-48710 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

aiida-graphql (>=0.0.1, <=0.0.2), postblog (>=0.4.1, <=0.5.2) +1 more potentially affected by CVE-2026-48710 via starlette (0.12.10)

starlette PYPI version 0.12.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aiida-graphql =0.0.1, =0.4.1, =0.16.5, =0.18.1 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

aioboot (0.3.0), dms (0.0.3) +3 more potentially affected by CVE-2026-48710 via starlette (0.13.0)

starlette PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aioboot 0.3.0 - dms 0.0.3 - piccolo-admin =0.3.1, =0.4.2, =0.18.2, =0.21.1 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5...

piccolo-admin (0.6.0), piccolo-api (0.7.0) +2 more potentially affected by CVE-2026-48710 via starlette (0.13.3)

starlette PYPI version 0.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - piccolo-admin 0.6.0 - piccolo-api 0.7.0 - starlette-graphql-zifulu =0.0.1a3, =0.22.0, =0.24.1 Source cves: CVE-2026-48710 Source advisory:...

GHSA-45JQ-C8XM-JFW9 Keystone: GraphQL API Endpoint Lacks Query Depth Limits

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

Keystone: GraphQL API Endpoint Lacks Query Depth Limits

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

CVE-2026-10802

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

CVE-2026-10802 keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

CVE-2026-10802 keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

EUVD-2026-34244

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

CVE-2026-10802

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

CVE-2026-10802

The CVE-2026-10802 impact is in keystonejs keystone’s GraphQL API Endpoint, specifically in packages/core/src/lib/core/queries/output-field.ts. The vulnerability arises from a manipulation that causes resource consumption and can be exploited remotely. Public exploitation is reported, and a fix i...

PT-2026-46250

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.172.0 through 0.315.6 Description The MaxAliasesLimiter extension fails to account for the multiplicative effect of FragmentSpreadNode. While static aliases within the Abstract Syntax Tree AST are counted, the...

PT-2026-46249

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.71.0 through 0.315.6 Description The QueryDepthLimiter extension is susceptible to an application-level Denial of Service DoS. This occurs because the determine depth function in query depth limiter.py lacks cycle...