These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
This PatchSiren debrief is based on the supplied source corpus for CVE-2026-107727, describing a conditional connection-level availability and resource-accounting issue in Strawberry's legacy `graphql-ws` subscription handler. The issue arises from the handler retaining task and subscription bookkeeping after a one-shot subscription has naturally sent its `complete` message. This can lead to clients reach [truncated]
CVE-2026-107728 Strawberry GraphQL Synchronous permission checks treat awaitable authorization result as truthy. The vulnerability affects synchronous field resolvers under both execute_sync() and execute() in versions from 0.217.0 to 0.326.1. Defenders should verify exposure, assess permission configurations, and upgrade to version 0.326.1 if necessary. This high-severity issue can allow unauthorized acc [truncated]
CVE-2026-47707 is a vulnerability in the MaxAliasesLimiter extension of Strawberry GraphQL, a library for creating GraphQL APIs. Versions 0.172.0 through 0.315.6 are affected. The extension fails to account for the multiplicative effect of FragmentSpreadNode, allowing attackers to bypass alias limits. This can lead to a denial-of-service (DOS) via resource exhaustion. The issue has been fixed in version 0.315.7.
CVE-2026-47706 is a medium-severity vulnerability in Strawberry GraphQL, a library for creating GraphQL APIs. The vulnerability affects versions 0.71.0 through 0.315.6 and is caused by a lack of cycle detection in fragment spreads, leading to an application-level denial of service (DOS). When a query contains circular fragment references, the `determine_depth` function enters an infinite recursion, result [truncated]
CVE-2026-45739 is a low-severity vulnerability in Strawberry GraphQL, a library for creating GraphQL APIs. The issue, patched in version 0.315.4, involves the bundled GraphiQL template writing values from the GraphiQL headers editor into the browser URL query string. This could potentially expose sensitive headers, such as authentication tokens, in browser history, copied links, and server/proxy/CDN acces [truncated]
