CVE-2026-47707: Strawberry GraphQL DoS via MaxAliasesLimiter bypass in FragmentSpreadNode

CVE-2026-47707 · Severity: medium · CVSS 5.3 · Published 2026-06-04

Strawberry GraphQL is a library used by developers to build GraphQL APIs. A flaw in its security filtering allows attackers to bypass limits on how many data aliases can be requested in a single query. By using a specific technique called fragment expansion, an attacker can force the server to process significantly more data than intended, potentially causing the service to slow down or crash due to resource exhaustion.

Technologies: strawberry-graphql (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-47707 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47707 being exploited in the wild.
How severe is CVE-2026-47707?
Medium severity, with a CVSS score of 5.3, published 4 June 2026.
Which products and versions are affected?
strawberry-graphql (PyPI) >= 0.172.0, <= 0.315.6, ECOSYSTEM:introduced=0.172.0,fixed=0.315.7.
Is there a fix for CVE-2026-47707?
Yes. strawberry-graphql (PyPI): upgrade to 0.315.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47707 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47707?
Check whether you run strawberry-graphql (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • strawberry-graphql (PyPI): upgrade to 0.315.7 or later
    pip install "strawberry-graphql>=0.315.7"

Technical details

The MaxAliasesLimiter extension in Strawberry GraphQL (versions 0.172.0 through 0.315.6) incorrectly calculates the number of aliases in a GraphQL request. While it counts static aliases within the Abstract Syntax Tree (AST), it fails to account for the amplification effect of FragmentSpreadNode. An attacker can define a fragment containing multiple aliases and reference that fragment numerous times; the limiter only counts the fragment definition once rather than multiplying it by the number of times it is spread. This allows a remote, unauthenticated attacker to trigger excessive CPU and memory consumption by forcing the server to resolve and render a much higher number of aliases than the configured limit. The issue is fixed in version 0.315.7 by ensuring fragment spreads are expanded during the alias counting process.

Affected products

  • Strawberry GraphQL strawberry-graphql >= 0.172.0, <= 0.315.6

Identifiers

  • CVE-2026-47707
  • GHSA-fr49-mhgj-crfc
  • PYSEC-2026-2284

Timeline

  • 2026-05-19: patched: Version 0.315.7 released
  • 2026-05-19: advisory: GitHub Security Advisory GHSA-fr49-mhgj-crfc published
  • 2026-06-04: disclosed: CVE-2026-47707 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.