CVE-2026-47706 Details
Description
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.
A denial-of-service vulnerability has been identified in the Strawberry GraphQL library, specifically in versions 0.71.0 prior to 0.315.6. The issue arises within the QueryDepthLimiter extension, which lacks proper cycle detection in fragment spreads. This vulnerability allows for application-level denial-of-service by creating queries with circular fragment references, causing the 'determine_depth' function to enter an infinite recursion. This unbounded recursion leads to a 'RecursionError', crashing the validation process and exhausting server resources.
Users can upgrade to Strawberry GraphQL version 0.315.7, which addresses this vulnerability by adding cycle detection in fragment spreads, preventing circular references from causing infinite recursion.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-qfwv-87qj-98xq | CISA-ADP | ExploitVendor Advisory |
| https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7 | [email protected] | ProductRelease Notes |
| https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-qfwv-87qj-98xq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| strawberry strawberry graphql | >= 0.71.0, < 0.315.7 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| Jun 4, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |