CVE-2026-35526

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35526", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-03T02:15:39.281Z", "datePublished": "2026-04-07T15:23:36.548Z", "dateUpdated": "2026-04-08T14:55:58.026Z"}, "containers": {"cna": {"title": "Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77"}], "affected": [{"vendor": "strawberry-graphql", "product": "strawberry", "versions": [{"version": "< 0.312.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T15:23:36.548Z"}, "descriptions": [{"lang": "en", "value": "Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3."}], "source": {"advisory": "GHSA-hv3w-m4g2-5x77", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T14:55:45.309490Z", "id": "CVE-2026-35526", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:55:58.026Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35526", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T14:55:45.309490Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:55:51.844Z"}}], "cna": {"title": "Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions", "source": {"advisory": "GHSA-hv3w-m4g2-5x77", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "strawberry-graphql", "product": "strawberry", "versions": [{"status": "affected", "version": "< 0.312.3"}]}], "references": [{"url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77", "name": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T15:23:36.548Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35526", "state": "PUBLISHED", "dateUpdated": "2026-04-08T14:55:58.026Z", "dateReserved": "2026-04-03T02:15:39.281Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T15:23:36.548Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "strawberry", "vendor": "strawberry-graphql", "versions": [{"status": "affected", "version": "< 0.312.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:*", "matchCriteriaId": "480FB826-3577-47DB-8F4B-B7B6F5C474E5", "versionEndExcluding": "0.312.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3."}, {"lang": "es", "value": "Strawberry GraphQL es una biblioteca para crear APIs GraphQL. Antes de la versi\u00f3n 0.312.3, los manejadores de suscripci\u00f3n WebSocket de Strawberry GraphQL, tanto para los protocolos graphql-transport-ws como para los legados graphql-ws, asignan una asyncio.Task y un objeto Operation asociado por cada mensaje de suscripci\u00f3n entrante sin aplicar ning\u00fan l\u00edmite en el n\u00famero de suscripciones activas por conexi\u00f3n. Un atacante no autenticado puede abrir una \u00fanica conexi\u00f3n WebSocket, enviar connection_init y luego inundar con mensajes de suscripci\u00f3n con IDs \u00fanicos. Cada mensaje genera incondicionalmente una nueva asyncio.Task y un generador as\u00edncrono, causando un crecimiento lineal de la memoria y la saturaci\u00f3n del bucle de eventos. Esto lleva a la degradaci\u00f3n del servidor o a un fallo por OOM. Esta vulnerabilidad se corrige en la versi\u00f3n 0.312.3."}], "id": "CVE-2026-35526", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35526", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T14:55:45.309490Z", "version": "2.0.3"}}]}, "published": "2026-04-07T16:16:28.843", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.312.3)"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "strawberry", "source": "cna", "vendor": "strawberry-graphql"}, "product": "strawberry", "vendor": "strawberry"}], "analysis": {"en": {"generated_at": "2026-04-07T22:47:15.503840+00:00", "value": {"mitigation_remediation": ["Upgrade Strawberry GraphQL to version 0.312.3 or later", "Monitor WebSocket connection usage for abnormal subscription rates"], "summary": {"action": "Patch Immediately", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is the Strawberry GraphQL library, used to build GraphQL APIs, when used in versions prior to 0.312.3. Users of the library in any environment\u2014be it web, mobile, or microservice\u2014are potentially impacted if they rely on the default WebSocket subscription implementation.", "description_and_impact": "The vulnerability resides in Strawberry GraphQL\u2019s WebSocket subscription handling, where each subscription message creates a new asyncio.Task and an Operation object without any cap on concurrent tasks. This unbounded allocation leads to linear memory growth and event loop saturation, eventually causing the server to degrade, become unresponsive, or crash with an out\u2011of\u2011memory condition. The weakness matches CWE\u2011770, reflecting an uncontrolled resource consumption flaw.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity. No EPSS score is available, and the vulnerability has not been listed in the CISA KEV catalog. The attack can be carried out by an unauthenticated adversary who opens a single WebSocket connection, sends connection_init, and floods the server with subscribe messages carrying unique IDs. Because each message spawns a new asynchronous generator, the server\u2019s memory continues to increase, eventually exhausting resources and leading to a denial of service. The absence of a limiting mechanism makes exploitation straightforward and highly likely when the vulnerable version is in use."}}}}, "created": "2026-04-08T19:48:14.489872+00:00", "updated": "2026-04-09T08:24:12.928922+00:00", "vendors": ["strawberry", "strawberry$PRODUCT$strawberry"]}