Strawberry vulnerabilities
We track 2 vulnerabilities in Strawberry products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 7, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Strawberry vulnerabilities
- 7.5 High severity
strawberry: Missing Authentication for Critical Functionality
Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init hands
- 7.5 High severity
strawberry: Allocation of Resources Without Limits or Throttling
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for eve