Executive brief
Strawberry GraphQL is a library used by developers to build GraphQL APIs. A flaw in its query depth limiting feature allows an attacker to crash the API service by sending a specially crafted request with circular references. This results in a denial-of-service (DoS) condition, making the application unavailable to legitimate users.
Technical details
The QueryDepthLimiter extension in Strawberry GraphQL fails to implement cycle detection when processing fragment spreads. Specifically, the 'determine_depth' function in 'query_depth_limiter.py' recursively resolves FragmentSpreadNodes without tracking visited fragments. An unauthenticated remote attacker can exploit this by submitting a GraphQL query containing circular fragment references (e.g., Fragment A referencing Fragment B, which references Fragment A). This triggers an infinite recursion, leading to a Python RecursionError that crashes the validation process and exhausts server resources. The issue is fixed in version 0.315.7 by implementing fragment tracking during depth calculation.
Affected products
- Strawberry GraphQL strawberry-graphql >= 0.71.0, < 0.315.7
Timeline
- 2026-05-19: patched: Version 0.315.7 released
- 2026-06-04: disclosed: CVE-2026-47706 published