Strawberry Graphql vulnerabilities

2 known vulnerabilities in Strawberry Graphql from Strawberry. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  strawberry: Missing Authentication for Critical Functionality

  CVE-2026-35523Apr 7, 2026Strawberry-graphql

  Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init hands

• 7.5 High severity

  strawberry: Allocation of Resources Without Limits or Throttling

  CVE-2026-35526Apr 7, 2026Strawberry-graphql

  Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for eve