CVE-2026-107727: Connection-Level Denial of Service via State Leak in Strawberry GraphQL Legacy WS Handler

Vulnerability ID: CVE-2026-107727
CVSS Score: 3.7
Published: 2026-10-09

An uncontrolled resource consumption vulnerability in Strawberry GraphQL allows unauthenticated remote attackers to trigger a Denial of Service on persistent WebSocket connections using the legacy graphql-ws protocol. When the server enforces max_subscriptions_per_connection, naturally terminating subscriptions are not cleared from memory registries, leading to exhaustion of connection slots.

TL;DR

A state leak in Strawberry GraphQL's legacy WebSocket handler causes naturally completed subscriptions to permanently consume connection slots under max_subscriptions_per_connection, enabling remote attackers to deny future subscription requests on persistent sessions.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 3.7 (Low)
  • EPSS Score: 0.0035 (Percentile: 26.60%)
  • Exploit Status: PoC available
  • CISA KEV Status: Not listed

Affected Systems

  • Strawberry GraphQL
  • Strawberry GraphQL: >= 0.312.3, < 0.327.2 (Fixed in: 0.327.2)

Code Analysis

Commit: 24c5e46

Fix memory leak in legacy graphql-ws subscription protocol handler by implementing a finally block to clean up task and subscription mappings on termination.

Exploit Details

  • GitHub Security Advisory: The advisory details the root cause and provides execution workflow examples that trigger the connection block.

Mitigation Strategies

  • Upgrade Strawberry GraphQL to version 0.327.2 or higher.
  • Migrate from the legacy 'graphql-ws' protocol to 'graphql-transport-ws'.
  • Deconfigure 'max_subscriptions_per_connection' to prevent limits from triggering.

Remediation Steps:

  1. Verify the current Strawberry GraphQL installation version.
  2. Execute 'pip install --upgrade strawberry-graphql>=0.327.2' to update the package.
  3. Update server initialization code to leverage graphql-transport-ws instead of the legacy protocol.
  4. Test subscription handling with unique, successive short-lived queries to verify memory cleanup.

References

Read the full report for CVE-2026-107727 on our website for more details including interactive diagrams and full exploit analysis.