CVE-2026-35526

The vulnerability allows an unauthenticated attacker to initiate a single WebSocket connection and then rapidly send a flood of unique subscription messages. Each message triggers the creation of a new asyncio.Task and associated Operation object, without any rate limiting. This uncontrolled task creation can quickly exhaust server resources, including CPU, memory, and potentially network bandwidth. The result is a denial of service, preventing legitimate users from accessing the GraphQL API. The blast radius extends to all users relying on the affected GraphQL endpoint, and the impact can be significant, especially in production environments.

Applications utilizing Strawberry GraphQL for building GraphQL APIs, particularly those exposed to untrusted networks or lacking robust authentication mechanisms, are at risk. Shared hosting environments where multiple applications share the same server resources are especially vulnerable, as a single attacker could impact all hosted applications.

• python / server:

import asyncio
import strawberry

# Check for Strawberry GraphQL version
import strawberry
print(strawberry.__version__)

# Monitor CPU and memory usage for unusual spikes during WebSocket connections
import psutil

while True:
    cpu_usage = psutil.cpu_percent(interval=1)
    memory_usage = psutil.virtual_memory().percent
    print(f'CPU Usage: {cpu_usage}%, Memory Usage: {memory_usage}%')
    asyncio.sleep(5)

1. 2026-04-07Disclosure

   disclosure

1. 已保留2026-04-03
2. 发布日期2026-04-07
3. 修改日期2026-04-08
4. EPSS 更新日期2026-04-15

The primary mitigation is to upgrade Strawberry GraphQL to version 0.312.3 or later, which includes a fix to limit the number of active subscriptions per connection. If upgrading immediately is not feasible, consider implementing rate limiting on the WebSocket connection to restrict the number of subscription messages received per unit of time. Web application firewalls (WAFs) can be configured to detect and block suspicious patterns of subscription requests. Monitoring server resource utilization (CPU, memory) is crucial to identify potential DoS attacks.