CVE-2026-47706: Strawberry Graphql

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.

Affected products

• Strawberry Strawberry Graphql: from 0.71.0, before 0.315.7 (fixed in 0.315.7)

Published 2026-06-04. Last modified 2026-07-22.