PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47707 strawberry-graphql CVE debrief

CVE-2026-47707 is a vulnerability in the MaxAliasesLimiter extension of Strawberry GraphQL, a library for creating GraphQL APIs. Versions 0.172.0 through 0.315.6 are affected. The extension fails to account for the multiplicative effect of FragmentSpreadNode, allowing attackers to bypass alias limits. This can lead to a denial-of-service (DOS) via resource exhaustion. The issue has been fixed in version 0.315.7.

Vendor
strawberry-graphql
Product
strawberry
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Users of Strawberry GraphQL, particularly those who have not upgraded to version 0.315.7, should be aware of this vulnerability and take necessary precautions.

Technical summary

The MaxAliasesLimiter extension in Strawberry GraphQL does not correctly account for the amplification effect of FragmentSpreadNode. This allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a DOS via resource exhaustion.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade to Strawberry GraphQL version 0.315.7 or later.
  • Review and adjust alias limits according to your application's specific needs.

Evidence notes

The CVE-2026-47707 record and associated details are sourced from official databases and vendor advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47707 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47707

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47707 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47707

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.