What is CVE-2026-107727?

CVE-2026-107727 is a low-severity vulnerability in Strawberry-Graphql Strawberry, classified under Uncontrolled Resource Consumption. CVSS score: 3.7/10. Published 2026-10-08.

How severe is CVE-2026-107727?

Low severity. CVSS v3 base score is 3.7 out of 10.

Resource exhaustion in Strawberry-Graphql Strawberry

CVE-2026-107727

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2.

Vulnerability class: DoS (Denial of Service)

Published 2026-10-08 · last modified 2026-10-09.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Strawberry-Graphql Strawberry — versions >= 0.312.3, < 0.327.2

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

Frequently asked questions

What is CVE-2026-107727?: CVE-2026-107727 is a low-severity vulnerability in Strawberry-Graphql Strawberry, classified under Uncontrolled Resource Consumption. CVSS score: 3.7/10. Published 2026-10-08.
How severe is CVE-2026-107727?: Low severity. CVSS v3 base score is 3.7 out of 10.