Strawberry GraphQL security vulnerability

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions of Strawberry GraphQL prior to 0.312.3 contained a security vulnerability. This vulnerability stemmed from the WebSocket subscription handler not limiting the number of active subscriptions per...

Strawberry GraphQL Access Control Vulnerability

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions of Strawberry GraphQL prior to 0.312.3 contained a security vulnerability related to access control. This vulnerability stemmed from an WebSocket subscription endpoints’ authentication process,...

CVE-2026-35523: Missing Authentication for Critical Function

Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connectioninit handshake has been completed before...

CVE-2026-35526: Allocation of Resources Without Limits or Throttling

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without...

strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions

Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An...

GHSA-HV3W-M4G2-5X77 strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions

Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An...

Allocation of Resources Without Limits or Throttling

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the WebSocket subscription handling process. An attacker can exhaust server resources by sending a large number of...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35526 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.8.1 and more Source cves: CVE-2026-35526 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-15922315...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35526 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.8.1 and more Source cves: CVE-2026-35526 Source advisory: GHSA-HV3W-M4G2-5X77...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35526 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.8.1 and more Source cves: CVE-2026-35526 Source advisory: OSV:GHSA-HV3W-M4G2-5X77...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35523 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.8.1 and more Source cves: CVE-2026-35523 Source advisory: OSV:GHSA-VPWC-V33Q-MQ89...

GHSA-VPWC-V33Q-MQ89 strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol

Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connectioninit handshake has been completed before processing start subscription messages. This allows a remote...

strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol

Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connectioninit handshake has been completed before processing start subscription messages. This allows a remote...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35523 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.8.1 and more Source cves: CVE-2026-35523 Source advisory: GHSA-VPWC-V33Q-MQ89...

Missing Authentication for Critical Function

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the onwsconnect process. An attacker can gain unauthorized access to WebSocket subscription endpoints by connecting with the...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35523 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.8.1 and more Source cves: CVE-2026-35523 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-15922312...

EUVD-2024-0208

Malicious code in bioql PyPI...

CVE-2025-22151

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

CVE-2024-47082

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable ...

CVE-2025-22151

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...