Lucene search
+L

18 matches found

Github Security Blog
Github Security Blog
added 2026/06/04 2:39 p.m.27 views

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Summary The MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this...

5.3CVSS6AI score0.00417EPSS
SaveExploits1References4Affected Software1
Rows per page
Query Builder