ST
Product
strawberry
8
CVEs
0
On KEV
7.5
Max CVSS
2
New 30D
Severity mix
Critical 0High 3Medium 3Low 2
Watch
Add strawberry to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107728 | 7.5 | Oct 8 | Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy Affected: >= 0.217.0, < 0.326.1 |
| CVE-2026-35523 | 7.5 | Apr 7 | Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol Affected: < 0.312.3 |
| CVE-2026-35526 | 7.5 | Apr 7 | Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions Affected: < 0.312.3 |
| CVE-2026-47707 | 5.3 | Jun 4 | Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification Affected: >= 0.172.0, < 0.315.7 |
| CVE-2026-47706 | 5.3 | Jun 4 | Strawberry GraphQL has a Circular Fragment Reference DOS Affected: >= 0.71.0, < 0.315.7 |
| CVE-2026-45739 | 4.3 | Jun 4 | Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs Affected: >= 0.288.4, < 0.315.4 |
| CVE-2026-107727 | 3.7 | Oct 8 | Strawberry legacy graphql-ws retains naturally completed subscription slots Affected: >= 0.312.3, < 0.327.2 |
| CVE-2025-22151 | 3.7 | Jan 9 | Strawberry GraphQL has a type resolution vulnerability Affected: >= 0.182.0, < 0.257.0 |
Showing 8