PYSEC-2026-4303 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

Strawberry legacy graphql-ws retains naturally completed subscription slots

SummaryStrawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

SummaryPermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable ...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +79 more potentially affected by CVE-2026-107728 via strawberry-graphql (>=0.217.0, <=0.325.0)

strawberry-graphql PYPI version =0.217.0, =2025.4.0, =2025.4.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.9.0, =25.13.0rc1, =1.2.0, =0.1.0a1, =0.2.0, =1.0.1, =2.2.1 and more Source cves: CVE-2026-107728 Source advisory: OSV:PYSEC-2026-4303...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +36 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =1.0.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =0.1.32 and more Source cves: CVE-2026-107727 Source advisory: OSV:PYSEC-2026-4302...

PYSEC-2026-4302 Strawberry legacy graphql-ws retains naturally completed subscription slots

Summary Strawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...

ROOT-APP-PYPI-CVE-2026-107728 CVE-2026-107728 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-107728 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +36 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =1.0.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =0.1.32 and more Source cves: CVE-2026-107727 Source advisory: OSV:GHSA-M952-2W3F-6R8H...

Strawberry legacy graphql-ws retains naturally completed subscription slots

Summary Strawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...

Allocation of Resources Without Limits or Throttling

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the legacy graphql-ws protocol handler in strawberry/subscriptions/protocols/graphqlws/handlers.py, where completed or...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +36 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =1.0.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =0.1.32 and more Source cves: CVE-2026-107727 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-20823901...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +36 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =1.0.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =0.1.32 and more Source cves: CVE-2026-107727 Source advisory: GHSA-M952-2W3F-6R8H...

GHSA-M952-2W3F-6R8H Strawberry legacy graphql-ws retains naturally completed subscription slots

Summary Strawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...

EUVD-2026-95391

Strawberry legacy graphql-ws retains naturally completed subscription slots...

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +79 more potentially affected by CVE-2026-107728 via strawberry-graphql (>=0.217.0, <=0.325.0)

strawberry-graphql PYPI version =0.217.0, =2025.4.0, =2025.4.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.9.0, =25.13.0rc1, =1.2.0, =0.1.0a1, =0.2.0, =1.0.1, =2.2.1 and more Source cves: CVE-2026-107728 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-20823910...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +79 more potentially affected by CVE-2026-107728 via strawberry-graphql (>=0.217.0, <=0.325.0)

strawberry-graphql PYPI version =0.217.0, =2025.4.0, =2025.4.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.9.0, =25.13.0rc1, =1.2.0, =0.1.0a1, =0.2.0, =1.0.1, =2.2.1 and more Source cves: CVE-2026-107728 Source advisory: GHSA-PFVF-FWFP-25MP...

GHSA-PFVF-FWFP-25MP Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

EUVD-2026-95392

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy...

Incorrect Authorization

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Incorrect Authorization via the synchronous resolve method in strawberry/permission.py when a haspermission method is defined as a plain def that returns a coroutine awaitable...