CVE-2026-47707 Details
Description
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion. Version 0.315.7 contains a fix for the issue.
A denial-of-service vulnerability has been identified in Strawberry GraphQL versions 0.172.0 prior to 0.315.6. The issue arises in the MaxAliasesLimiter extension, which fails to properly account for the amplification effect of fragment spreads. While the extension accurately counts static aliases in the Abstract Syntax Tree (AST), it does not consider how many times a fragment's internal aliases are expanded during execution. This oversight allows an attacker to bypass alias limits, forcing the server to resolve and render a significantly higher number of aliases than permitted, potentially leading to resource exhaustion and a denial-of-service condition.
Users can upgrade to Strawberry GraphQL version 0.315.7, which addresses this vulnerability by improving the alias counting mechanism to account for fragment spread amplifications.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc | CISA-ADP | ExploitVendor Advisory |
| https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7 | [email protected] | ProductRelease Notes |
| https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| strawberry strawberry graphql | >= 0.172.0, < 0.315.7 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| Jun 4, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |