CVE-2026-35526 Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions
An unauthenticated attacker can cause server crashes or degradation by flooding WebSocket subscriptions in Strawberry GraphQL, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35526?
CVE-2026-35526 is a high-severity denial of service vulnerability in strawberry-graphql strawberry, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3.
Weakness: CWE-770
Which versions are affected by CVE-2026-35526?
3 open source packages ship an affected version, including strawberry-graphql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
strawberry-graphql PyPI | All versions | 0.312.3 |
strawberry-graphql PyPI | All versions | 0.312.3 |
strawberry-graphql PyPI | All versions | 0.312.3 |
Products include Strawberry Strawberry Graphql.
How do I fix CVE-2026-35526?
Upgrade strawberry-graphql to 0.312.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-35526 being exploited?
There is no known exploitation of CVE-2026-35526 in the wild and no public exploit code.
Other vulnerabilities in strawberry-graphql strawberry
- CVE-2026-35523 Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol
- CVE-2026-47706 Strawberry GraphQL has a Circular Fragment Reference DOS
- CVE-2026-47707 Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
- CVE-2026-45739 Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
Sources
Also known as GHSA-hv3w-m4g2-5x77, PYSEC-2026-134, ROOT-APP-PYPI-CVE-2026-35526.