CVE-2026-47707

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion. Version 0.315.7 contains a fix for the issue.

• CWE-400

• https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7Product, Release Notes
• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfcExploit, Vendor Advisory
• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfcExploit, Vendor Advisory

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4770Improper neutralization of input during web page generation …4.6
• CVE-2026-47702TypeBot is a chatbot builder tool. In version 3.16.1, API to…9.1
• CVE-2026-47703AdGuard Home is a network-wide software for blocking ads and…5.3
• CVE-2026-47704TypeBot is a chatbot builder tool. Prior to version 3.17.0, …7.1
• CVE-2026-47705TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV …9.6
• CVE-2026-47706Strawberry GraphQL is a library for creating GraphQL APIs. I…5.3
• CVE-2026-47708MCP-for-Stata is an MCP server for Stata to integrate Stata …9.3
• CVE-2026-47709libheif is a HEIF and AVIF file format decoder and encoder. …5.5
• CVE-2026-47712Dulwich is a pure-Python implementation of the Git file form…3.3
• CVE-2026-47713AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-47714libheif is a HEIF and AVIF file format decoder and encoder. …6.1
• CVE-2026-47715Bugsink is a self-hosted error tracking tool. Prior to 2.2.0…3.1