Sstrawberry-graphql

Products

Exploited and recent CVEs

• CVE-2026-107728 High 7.5 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy 0.4%
• CVE-2026-107727 Low 3.7 Strawberry legacy graphql-ws retains naturally completed subscription slots 0.4%
• CVE-2026-47707 Medium 5.3 Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification 0.5%
• CVE-2026-45739 Low 3.1 Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs 0.2%
• CVE-2026-47706 Medium 5.3 Strawberry GraphQL has a Circular Fragment Reference DOS 0.3%
• CVE-2026-35523 High 7.5 Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol 0.4%
• CVE-2026-35526 High 7.5 Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions 0.3%
• CVE-2025-22151 Low 3.7 Strawberry GraphQL has a type resolution vulnerability 0.4%
• CVE-2024-47082 Medium 4.6 Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability 0.2%