WebSocket Subscription Vulnerability in Strawberry GraphQL Library

CVE-2026-35526

What is CVE-2026-35526?

The Strawberry GraphQL library, used for building GraphQL APIs, contains an improper resource management vulnerability related to WebSocket subscription handlers. Prior to version 0.312.3, the library lacked controls on the number of active subscriptions per WebSocket connection. This flaw enables unauthenticated attackers to establish a single connection and inundate the server with subscribe messages, each creating a new asyncio.Task and async generator without limits. This can lead to significant memory use and can degrade server performance, potentially resulting in an out-of-memory crash.

References