CVE-2026-47706: Strawberry GraphQL Denial of Service via Uncontrolled Recursion in QueryDepthLimiter

CVE-2026-47706 · Severity: medium · CVSS 5.3 · Published 2026-06-04

Strawberry GraphQL is a library used by developers to build GraphQL APIs. A flaw in its query depth limiting feature allows an attacker to crash the API service by sending a specially crafted request with circular references. This results in a denial-of-service (DoS) condition, making the application unavailable to legitimate users.

Technologies: strawberry-graphql (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-47706 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47706 being exploited in the wild.
How severe is CVE-2026-47706?
Medium severity, with a CVSS score of 5.3, published 4 June 2026.
Which products and versions are affected?
strawberry-graphql (PyPI) >= 0.71.0, <= 0.315.6, ECOSYSTEM:introduced=0.71.0,fixed=0.315.7.
Is there a fix for CVE-2026-47706?
Yes. strawberry-graphql (PyPI): upgrade to 0.315.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47706 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47706?
Check whether you run strawberry-graphql (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • strawberry-graphql (PyPI): upgrade to 0.315.7 or later
    pip install "strawberry-graphql>=0.315.7"

Technical details

The QueryDepthLimiter extension in Strawberry GraphQL fails to implement cycle detection when processing fragment spreads. Specifically, the 'determine_depth' function in 'query_depth_limiter.py' recursively resolves FragmentSpreadNodes without tracking visited fragments. An unauthenticated remote attacker can exploit this by submitting a GraphQL query containing circular fragment references (e.g., Fragment A referencing Fragment B, which references Fragment A). This triggers an infinite recursion, leading to a Python RecursionError that crashes the validation process and exhausts server resources. The issue is fixed in version 0.315.7 by implementing fragment tracking during depth calculation.

Affected products

  • Strawberry GraphQL strawberry-graphql >= 0.71.0, < 0.315.7

Identifiers

  • CVE-2026-47706
  • GHSA-qfwv-87qj-98xq
  • PYSEC-2026-2283

Timeline

  • 2026-05-19: patched: Version 0.315.7 released
  • 2026-06-04: disclosed: CVE-2026-47706 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.