Low severity · published Oct 8, 2026
CVE-2026-107727
Strawberry legacy graphql-ws retains naturally completed subscription slots
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
strawberry · strawberry-graphql
>= 0.312.3, < 0.327.2 · source: vendor
Affected product
ST
strawberry
strawberry-graphql
More from strawberry
7.5
CVE-2026-107728
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
7.5
CVE-2026-35523
Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol
7.5
CVE-2026-35526
Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions
5.3
CVE-2026-47707
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
5.3
CVE-2026-47706
Strawberry GraphQL has a Circular Fragment Reference DOS