Vulnerability · Published Jun 4, 2026 · Assigned by GitHub_M

CVE-2026-47706Strawberry GraphQL has a Circular Fragment Reference DOS

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in strawberry from strawberry-graphql. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 77.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	strawberry-graphql	0.315.7	GHSA-qfwv-87qj-98xq
PyPI	strawberry-graphql	0.315.7	PYSEC-2026-2283

Affected products (as reported)

Vendor	Product	Versions
strawberry-graphql	strawberry	>= 0.71.0, < 0.315.7

Weakness: CWE-400, CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-qfwv-87qj-98xq x_refsource_CONFIRM
https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7 x_refsource_MISC