Skip to contentStrawberry-graphql Strawberry vulnerabilities
- strawberry-graphql strawberryStrawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthyCVE-2026-107728Fix available7.5 High
- strawberry-graphql strawberryStrawberry legacy graphql-ws retains naturally completed subscription slotsCVE-2026-107727Fix available3.7 Low
- strawberry graphql, strawberry-graphql strawberry +1 moreStrawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias AmplificationCVE-2026-47707Fix available5.3 Medium
- strawberry graphql, strawberry-graphql strawberry +1 moreStrawberry GraphQL has a Circular Fragment Reference DOSCVE-2026-47706Fix available5.3 Medium
- strawberry graphql, strawberry-graphql strawberry +1 moreStrawberry GraphQL: Default GraphiQL may expose HTTP headers in URLsCVE-2026-45739Fix available3.1 Low
- strawberry graphql, strawberry-graphql strawberry +1 moreStrawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptionsCVE-2026-35526Fix available7.5 High
- strawberry graphql, strawberry-graphql strawberry +1 moreAuthentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocolCVE-2026-35523Fix available7.5 High
- strawberry-graphql strawberryStrawberry GraphQL has a type resolution vulnerabilityCVE-2025-22151Fix available3.7 Low
- strawberry-graphql strawberryStrawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerabilityCVE-2024-47082Fix available4.6 Medium