PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107727 strawberry-graphql CVE debrief

The Strawberry GraphQL library, specifically versions 0.312.3 to 0.327.2, contains a vulnerability in its legacy graphql-ws subscription handler. This handler fails to remove naturally completed operations from its task and subscription lists. As a result, when the max_subscriptions_per_connection parameter is configured, a client can exploit this flaw by using distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions have sent a complete message. This can lead to legitimate operations being rejected with a 'Subscription limit reached' error. The modern graphql-transport-ws protocol and deployments without the per-

Vendor
strawberry-graphql
Product
strawberry
CVSS
LOW 3.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-08
Original CVE updated
2026-10-08
Advisory published
2026-10-08
Advisory updated
2026-10-08

Who should care

Defenders managing GraphQL APIs using Strawberry GraphQL library, especially those with max_subscriptions_per_connection configured, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-107727 allows legitimate operations to be rejected due to a flaw in the legacy graphql-ws subscription handler in Strawberry GraphQL library versions 0.312.3 to 0.327.2, impacting deployments with max_subscriptions_per_connection configured.

  • Legitimate operations may be rejected with 'Subscription limit reached'
  • Verification of affected versions and configurations is necessary
  • Upgrading to version 0.327.2 or later is recommended

Technical summary

The legacy graphql-ws subscription handler in Strawberry GraphQL library versions 0.312.3 to 0.327.2 does not remove naturally completed operations from self.tasks and self.subscriptions. This allows clients to fill configured subscription slots even after those subscriptions send complete, impacting deployments with max_subscriptions_per_connection configured. Legitimate operations may be rejected with 'Subscription limit reached'. The issue is fixed in version 0.327.2. Defenders should assess exposure, verify affected versions, and prioritize upgrading to the fixed version.

Defensive priority

Defenders should assess exposure and prioritize verification of affected versions, as the issue allows legitimate operations to be rejected with 'Subscription limit reached' when max_subscriptions_per_connection is configured.

Recommended defensive actions

  • Assess exposure by checking if versions 0.312.3 to 0.327.2 are in use
  • Verify max_subscriptions_per_connection configuration and its impact
  • Prioritize upgrading to version 0.327.2 or later
  • Review WebSocket connection usage and subscription management
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the vulnerability in Strawberry GraphQL library versions from 0.312.3 until 0.327.2, affecting the legacy graphql-ws subscription handler. Evidence is limited to source-provided information and CVE metadata. Defenders should verify affected versions and configurations, focusing on deployments with max_subscriptions_per_connection configured. Additional source references may be necessary to fully understand the vulnerability's impact and verify affected systems.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107727 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107727

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107727 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107727

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Strawberry legacy graphql-ws retains naturally completed subscription slots

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107727.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/strawberry-graphql/strawberry/pull/4610

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/strawberry-graphql/strawberry/commit/24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/strawberry-graphql/strawberry/releases/tag/0.327.2

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.