CVE-2026-35526
strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions
Impact
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | strawberry-graphql | <= 0.312.2 | 0.312.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Strawberry | Strawberry Graphql | before 0.312.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-hv3w-m4g2-5x77
- https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77
- https://github.com/strawberry-graphql/strawberry/commit/0977a4e6b41b7cfe3e9d8ba84a43458a2b0c54c2
- https://github.com/strawberry-graphql/strawberry/releases/tag/0.312.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-35526
- https://github.com/pypa/advisory-database/tree/main/vulns/strawberry-graphql/PYSEC-2026-134.yaml