CVE-2026-107727
Description
A flaw was found in strawberry-graphql, which could lead to a denial of service (DoS) on affected connections. When a limit on subscriptions per connection is configured, the legacy subscription handler fails to properly remove completed operations from internal tracking. A remote client can exhaust the allocated connection slots by sending multiple short-lived subscription requests over a persistent connection, causing subsequent legitimate operations on that connection to be rejected.
Statement
A LOW severity denial-of-service flaw was found in the legacy graphql-ws subscription handler of strawberry-graphql, a Python GraphQL library included in the Red Hat Exploit Intelligence vulnerability-analysis-rhel9 container. When a limit on subscriptions per connection is configured, the legacy handler does not remove naturally completed operations from its internal tracking. A remote client on a persistent WebSocket connection can send many short-lived subscription requests with distinct operation IDs to fill the connection's configured subscription slots even after those subscriptions complete, causing subsequent legitimate operations on that connection to be rejected. Exploitation requires both the legacy graphql-ws protocol and an explicitly configured per-connection subscription limit; the modern graphql-transport-ws protocol and deployments without the configured cap are not affected. Within Red Hat, the only product in scope is the Exploit Intelligence vulnerability-analysis-rhel9 container, whose update stream is not in full support scope, so the affect is recorded as out of support scope and no Red Hat fix is planned for that stream. The Red Hat severity of LOW (CVSS 3.1 score 3.7) is consistent with the upstream assessment.
Mitigation
Affected deployments can mitigate this issue by migrating from the legacy graphql-ws subscription protocol to the modern graphql-transport-ws protocol, which is not affected, or by removing the configured max_subscriptions_per_connection limit, since deployments without the per-connection cap are not affected. Because the exhausted subscription slots are tracked per WebSocket connection, closing the affected connection restores capacity on new connections. Upstream fixed this issue in strawberry-graphql 0.327.2; the affected Red Hat Exploit Intelligence stream is out of support scope, so no Red Hat update is planned for it.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
