{"uuid": "6a385286-fa10-4d36-acb2-be152e6fa462", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-m952-2w3f-6r8h", "type": "seen", "source": "https://gist.github.com/alon710/1dc7d44d0acfa87a84fb3000275abfe1", "content": "# CVE-2026-107727: CVE-2026-107727: Connection-Level Denial of Service via State Leak in Strawberry GraphQL Legacy WS Handler\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-10-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107727\n\n## Summary\nAn uncontrolled resource consumption vulnerability in Strawberry GraphQL allows unauthenticated remote attackers to trigger a Denial of Service on persistent WebSocket connections using the legacy graphql-ws protocol. When the server enforces max_subscriptions_per_connection, naturally terminating subscriptions are not cleared from memory registries, leading to exhaustion of connection slots.\n\n## TL;DR\nA state leak in Strawberry GraphQL's legacy WebSocket handler causes naturally completed subscriptions to permanently consume connection slots under max_subscriptions_per_connection, enabling remote attackers to deny future subscription requests on persistent sessions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 3.7 (Low)\n- **EPSS Score**: 0.0035 (Percentile: 26.60%)\n- **Exploit Status**: PoC available\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Strawberry GraphQL\n- **Strawberry GraphQL**: >= 0.312.3, < 0.327.2 (Fixed in: `0.327.2`)\n\n## Mitigation\n\n- Upgrade Strawberry GraphQL to version 0.327.2 or higher.\n- Migrate from the legacy 'graphql-ws' protocol to 'graphql-transport-ws'.\n- Deconfigure 'max_subscriptions_per_connection' to prevent limits from triggering.\n\n**Remediation Steps:**\n1. Verify the current Strawberry GraphQL installation version.\n2. Execute 'pip install --upgrade strawberry-graphql>=0.327.2' to update the package.\n3. Update server initialization code to leverage graphql-transport-ws instead of the legacy protocol.\n4. Test subscription handling with unique, successive short-lived queries to verify memory cleanup.\n\n## References\n\n- [GitHub Security Advisory GHSA-m952-2w3f-6r8h](https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h)\n- [Strawberry GraphQL Pull Request #4610](https://github.com/strawberry-graphql/strawberry/pull/4610)\n- [Fix Commit 24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92](https://github.com/strawberry-graphql/strawberry/commit/24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92)\n- [Strawberry GraphQL Release 0.327.2](https://github.com/strawberry-graphql/strawberry/releases/tag/0.327.2)\n- [Official CVE.org Listing](https://www.cve.org/CVERecord?id=CVE-2026-107727)\n- [NVD Directory Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-107727)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107727) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T15:30:29.000000Z"}