Low severity · published Oct 8, 2026
CVE-2026-107727
Strawberry legacy graphql-ws retains naturally completed subscription slots
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
strawberry · strawberry-graphql
>= 0.312.3, < 0.327.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107727
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107727
x_refsource_CONFIRM
https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h
x_refsource_MISC
https://github.com/strawberry-graphql/strawberry/pull/4610
x_refsource_MISC
https://github.com/strawberry-graphql/strawberry/commit/24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92
x_refsource_MISC
https://github.com/strawberry-graphql/strawberry/releases/tag/0.327.2
More from strawberry
7.5
CVE-2026-107728
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
7.5
CVE-2026-35523
Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol
7.5
CVE-2026-35526
Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions
5.3
CVE-2026-47707
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
5.3
CVE-2026-47706
Strawberry GraphQL has a Circular Fragment Reference DOS
