CVE-2026-47707
Fragment Spread Amplification Bypass in Strawberry GraphQL
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| strawberry_graphql | strawberry | From 0.172.0 (inc) to 0.315.6 (inc) |
| strawberry_graphql | strawberry | 0.315.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability CVE-2026-47707 affects the Strawberry GraphQL library, specifically versions 0.172.0 through 0.315.6. It involves the MaxAliasesLimiter extension, which is intended to limit the number of aliases in GraphQL queries to prevent resource exhaustion.
However, the extension fails to account for the amplification effect caused by fragment spreads. While it correctly counts static aliases in the query's abstract syntax tree (AST), it does not consider how many times a fragment's internal aliases are expanded during execution.
An attacker can exploit this by crafting a query that appears to be within the alias limit in the AST but actually causes the server to resolve and render a much higher number of aliases due to repeated fragment expansions. This can lead to excessive CPU and memory consumption, resulting in a denial-of-service (DoS) condition.
The issue was fixed in version 0.315.7 of Strawberry GraphQL.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to bypass alias limits in GraphQL queries and cause your server to process a significantly higher number of aliases than intended.
As a result, the server may experience excessive CPU and memory usage, potentially leading to resource exhaustion and a denial-of-service (DoS) condition. This can make your GraphQL API unavailable or degrade its performance.
The vulnerability can be exploited remotely without any privileges or user interaction.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying if the Strawberry GraphQL library versions 0.172.0 through 0.315.6 are in use and monitoring for unusual resource consumption patterns caused by excessive alias resolution.
Since the vulnerability is related to the MaxAliasesLimiter extension failing to count expanded aliases from fragment spreads, detection can include analyzing GraphQL queries for fragment spreads that could amplify alias counts beyond expected limits.
Specific commands are not provided in the resources, but general approaches include:
- Checking the version of Strawberry GraphQL in your environment, for example by inspecting package manifests or using package management commands like `pip show strawberry-graphql`.
- Monitoring server logs and metrics for spikes in CPU and memory usage during GraphQL query execution.
- Using GraphQL query logging or tracing tools to identify queries with high alias counts or excessive fragment spreads.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the Strawberry GraphQL library to version 0.315.7 or later, where the vulnerability has been fixed.
Until the upgrade can be applied, consider implementing additional query complexity limits or rate limiting on your GraphQL API to reduce the risk of denial-of-service attacks caused by excessive alias resolution.
Monitoring and alerting on unusual resource consumption patterns can also help detect exploitation attempts early.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Strawberry GraphQL allows an attacker to bypass alias limits and cause a denial-of-service (DoS) via resource exhaustion by exploiting the amplification effect of fragment spreads. This leads to excessive CPU and memory consumption.
While the vulnerability primarily impacts availability by enabling DoS attacks, there is no direct information provided about its impact on confidentiality or integrity, which are critical for compliance with standards like GDPR or HIPAA.
Therefore, based on the provided information, this vulnerability could indirectly affect compliance by causing service disruptions, which may impact availability requirements under certain regulations, but no explicit compliance impact is detailed.