CVE-2026-107727: Strawberry GraphQL Subscription Limit Issue
Summary
CVE-2026-107727: Strawberry legacy graphql-ws retains naturally completed subscription slots. Affects strawberry-graphql versions >= 0.312.3, < 0.327.2. Fixed in 0.327.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Strawberry is a Python library for building GraphQL APIs, designed to be simple and intuitive. It supports various protocols, including the legacy 'graphql-ws' for subscriptions. This library allows developers to create real-time applications with ease, but it has a vulnerability in its subscription handling that can lead to resource accounting issues.
Vulnerability Detail
The vulnerability arises from the legacy 'graphql-ws' subscription handler in Strawberry, which retains bookkeeping for completed subscriptions. When a client uses distinct operation IDs, it can reach the maximum subscription limit set by 'max_subscriptions_per_connection', even though earlier subscriptions have completed. This can lead to legitimate subscription requests being rejected with a 'Subscription limit reached' error, impacting connection-level availability and resource management. The issue is conditional and requires specific configurations, making it a targeted concern for applications using the legacy protocol.
How To Fix
Latest published version: 0.336.2 as of 22 Oct 2026
pip install --upgrade "strawberry-graphql==0.336.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.327.2
This is the first release that contains the fix.
pip install --upgrade "strawberry-graphql==0.327.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the legacy 'graphql-ws' protocol if possible, or avoid setting 'max_subscriptions_per_connection' to a low value. This will help mitigate the impact of the vulnerability until the package can be updated.
Conclusion
The CVE-2026-107727 vulnerability in the Strawberry GraphQL library poses a risk to applications using the legacy 'graphql-ws' protocol. By retaining completed subscriptions in bookkeeping, it can lead to legitimate requests being blocked. Updating to the patched version 0.327.2 is essential to mitigate this issue.
See every vulnerability recorded for strawberry-graphql →
FAQ
The vulnerability allows completed subscriptions to still count against the maximum subscription limit, potentially blocking new legitimate subscriptions.
You can use the Vulert playground to monitor and check for vulnerabilities in your application without needing to sign up.
The affected versions are from 0.312.3 to 0.327.0. Ensure you upgrade to 0.327.2 or later to resolve the issue.
The primary impact is on connection-level availability, where legitimate subscription requests may be denied due to incorrect resource accounting.
While the vulnerability does not directly lead to memory exhaustion, multiple long-lived connections could increase retained task state, which may lead to resource issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for strawberry-graphql.
