CVE-2026-35526: Strawberry GraphQL Denial of Service via unbounded WebSocket subscriptions

Executive brief

Strawberry GraphQL is a library used to build GraphQL APIs in Python. A vulnerability in its WebSocket handling allows an unauthenticated attacker to crash the server or cause significant performance slowdowns by flooding it with subscription requests. This can lead to a total service outage, preventing legitimate users from accessing the application.

Technical details

Strawberry GraphQL's WebSocket subscription handlers for both `graphql-transport-ws` and the legacy `graphql-ws` protocols fail to enforce limits on the number of active subscriptions per connection. An unauthenticated remote attacker can initiate a WebSocket connection and flood the server with 'subscribe' messages containing unique IDs. Each message triggers the allocation of an `asyncio.Task` and an `Operation` object, leading to linear memory growth and event loop saturation. This results in an Out-of-Memory (OOM) crash or severe server degradation. The issue is fixed in version 0.312.3.

Affected products

• strawberry-graphql strawberry-graphql <= 0.312.2

Timeline

• 2026-04-04: disclosed: Initial disclosure by patrick91
• 2026-04-06: advisory: GitHub Advisory published
• 2026-04-07: other: NVD published CVE-2026-35526

References

• https://api.github.com/users/JFOZ1010
• https://github.com/JFOZ1010
• https://api.github.com/users/JFOZ1010/gists%7B/gist_id%7D
• https://api.github.com/users/JFOZ1010/repos
• https://avatars.githubusercontent.com/u/82562585?v=4
• https://api.github.com/users/JFOZ1010/events%7B/privacy%7D