Skip to content
OpenAdvisories

Vendor

strawberry-graphql

9 known vulnerabilities.

Products

strawberry 9
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-47707

    Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

    Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static a…

    strawberry-graphql strawberry strawberry-graphql PyPI
  • Medium 5.3
    CVE-2026-47706

    Strawberry GraphQL has a Circular Fragment Reference DOS

    Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragm…

    strawberry-graphql strawberry strawberry-graphql PyPI
  • Medium 4.6
    CVE-2024-47082

    Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability

    Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawbe…

    strawberry-graphql strawberry strawberry-graphql PyPI