Vulnerability PYSEC-2026-2283
Medium Risk
MEDIUM RISK
CVSS Score: 5.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
June 04, 2026 at 03:16 PM UTC
No summary available
0.71.0 - 0.315.6
0.71.0 - 0.315.6
Details
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
6 hours ago
Strawberry legacy graphql-ws retains naturally completed subscription slots
0.312.3 - 0.327.1 GHSA-m952-2w3f-6r8h
0.312.3 - 0.327.1 GHSA-m952-2w3f-6r8h
High Risk
6 hours ago
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
0.217.0 - 0.326.0 GHSA-pfvf-fwfp-25mp
0.217.0 - 0.326.0 GHSA-pfvf-fwfp-25mp
Low Risk
3 months ago
Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution
0.182.0 - 0.257.0.dev1735244504 PYSEC-2026-1946
0.182.0 - 0.257.0.dev1735244504 PYSEC-2026-1946
Medium Risk
4 months ago
No summary available
0.172.0 - 0.315.6 PYSEC-2026-2284
0.172.0 - 0.315.6 PYSEC-2026-2284
Medium Risk
4 months ago
No summary available
0.288.4 - 0.315.3 PYSEC-2026-2282
0.288.4 - 0.315.3 PYSEC-2026-2282
Impacted packages
Timeline
Published
4 months ago
June 04, 2026 at 03:16 PM UTC
Fixed (0.315.7)
4 months ago
May 19, 2026 at 04:50 PM UTC
Last Modified
2 months ago
July 13, 2026 at 07:15 AM UTC