strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions

CAO 7.5CVE-2026-35526 · GHSA-hv3w-m4g2-5x77 · PYSEC-2026-134 · Công bố 07/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-35526 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng strawberry-graphql, strawberry graphql (strawberry).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.27%, cao hơn 19.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.312.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
strawberry-graphql PyPI	`< 0.312.3`	`0.312.3`
strawberry graphql strawberry	`< 0.312.3`	`0.312.3`

Mô tả

Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection.

An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash.

Mô tả của NVD

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3.