Strawberry-graphql vulnerabilities

Products

• Strawberry 9

Newest

• strawberry-graphql strawberry Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy CVE-2026-107728 Fix available 7.5 HighOctober 8, 2026
• strawberry-graphql strawberry Strawberry legacy graphql-ws retains naturally completed subscription slots CVE-2026-107727 Fix available 3.7 LowOctober 8, 2026
• strawberry graphql, strawberry-graphql strawberry +1 more Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification CVE-2026-47707 Fix available 5.3 MediumJune 4, 2026
• strawberry graphql, strawberry-graphql strawberry +1 more Strawberry GraphQL has a Circular Fragment Reference DOS CVE-2026-47706 Fix available 5.3 MediumJune 4, 2026
• strawberry graphql, strawberry-graphql strawberry +1 more Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs CVE-2026-45739 Fix available 3.1 LowMay 19, 2026
• strawberry graphql, strawberry-graphql strawberry +1 more Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions CVE-2026-35526 Fix available 7.5 HighApril 6, 2026
• strawberry graphql, strawberry-graphql strawberry +1 more Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol CVE-2026-35523 Fix available 7.5 HighApril 6, 2026
• strawberry-graphql strawberry Strawberry GraphQL has a type resolution vulnerability CVE-2025-22151 Fix available 3.7 LowJanuary 9, 2025
• strawberry-graphql strawberry Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability CVE-2024-47082 Fix available 4.6 MediumSeptember 25, 2024