CVE-2026-47706

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.

• CWE-400
• CWE-674

• https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7Product, Release Notes
• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-qfwv-87qj-98xqExploit, Vendor Advisory
• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-qfwv-87qj-98xqExploit, Vendor Advisory

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47697Shelf is a platform for tracking physical assets. Shelf is m…7.1
• CVE-2026-4770Improper neutralization of input during web page generation …4.6
• CVE-2026-47702TypeBot is a chatbot builder tool. In version 3.16.1, API to…9.1
• CVE-2026-47703AdGuard Home is a network-wide software for blocking ads and…5.3
• CVE-2026-47704TypeBot is a chatbot builder tool. Prior to version 3.17.0, …7.1
• CVE-2026-47705TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV …9.6
• CVE-2026-47707Strawberry GraphQL is a library for creating GraphQL APIs. I…5.3
• CVE-2026-47708MCP-for-Stata is an MCP server for Stata to integrate Stata …9.3
• CVE-2026-47709libheif is a HEIF and AVIF file format decoder and encoder. …5.5
• CVE-2026-47712Dulwich is a pure-Python implementation of the Git file form…3.3
• CVE-2026-47713AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-47714libheif is a HEIF and AVIF file format decoder and encoder. …6.1