Medium
Strawberry GraphQL has a Circular Fragment Reference DOS
Type: advisorySources: OSV
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-47706
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 02:18 UTC · Revision 1
Source evidence
Strawberry GraphQL has a Circular Fragment Reference DOS
core-osv · Original sourcePublished 4 Jun 2026, 14:06 UTC
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.
osv:CVE-2026-47706
Complete source record
{
"id": "2994d54d334f72ce1965bc1d81e5326b038bf39344a8980d29c2a19cd0a4928e",
"url": "https://osv.dev/vulnerability/CVE-2026-47706",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Strawberry GraphQL has a Circular Fragment Reference DOS",
"summary": "Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.",
"evidence": "osv:CVE-2026-47706",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-47706",
"aliases": [
"CVE-2026-47706",
"GHSA-qfwv-87qj-98xq",
"PYSEC-2026-2283"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/strawberry-graphql/strawberry",
"type": "GIT",
"events": [
{
"introduced": "aa203a120a64d253ea83e87b45528d8187dc53a9"
},
{
"fixed": "a69221fb0b86583ceb5755758b294c8319021fd1"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0.71.0"
},
{
"fixed": "0.315.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "a69221fb0b86583ceb5755758b294c8319021fd1"
}
],
"source": "REFERENCES_TAG",
"original_tag": "0.315.7"
},
{
"cpe": "cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:*",
"range": [
{
"introduced": "0.71.0"
},
{
"fixed": "0.315.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"0.315.6",
"0.315.5",
"0.315.4",
"0.315.3",
"0.315.2",
"0.315.1",
"0.315.0",
"0.314.3",
"0.314.2",
"0.314.1",
"0.314.0",
"0.313.0",
"0.312.4",
"0.312.3",
"0.312.2",
"0.312.1",
"0.312.0",
"0.311.3",
"0.311.2",
"0.311.1",
"0.311.0",
"0.310.2",
"0.310.1",
"0.310.0",
"0.309.0",
"0.308.3",
"0.308.2",
"0.308.1",
"0.308.0",
"0.307.1",
"0.307.0",
"0.289.0",
"0.306.0",
"0.305.0",
"0.304.0",
"0.303.1",
"0.303.0",
"0.302.0",
"0.301.0",
"0.300.0",
"0.299.0",
"0.298.1",
"0.298.0",
"0.297.0",
"0.296.2",
"0.296.1",
"0.296.0",
"0.295.0",
"0.294.0",
"0.293.0",
"0.292.0",
"0.291.3",
"0.291.2",
"0.291.1",
"0.291.0",
"0.290.0",
"0.289.8",
"0.289.7",
"0.289.6",
"0.289.5",
"0.289.4",
"0.289.3",
"0.289.2",
"0.289.1",
"0.288.4",
"0.288.3",
"0.288.2",
"0.288.1",
"0.288.0",
"0.287.4",
"0.287.2",
"0.287.3",
"0.287.1",
"0.287.0",
"0.286.1",
"0.286.0",
"0.285.0",
"0.284.4",
"0.284.3",
"0.284.2",
"0.284.1",
"0.284.0",
"0.283.3",
"0.283.2",
"0.283.1",
"0.283.0",
"0.282.0",
"0.281.0",
"0.280.0",
"0.279.0",
"0.278.1",
"0.278.0",
"0.277.1",
"0.277.0",
"0.276.2",
"0.276.1",
"0.276.0",
"0.275.7",
"0.275.6",
"0.275.5",
"0.275.4",
"0.275.3",
"0.275.2",
"0.275.1",
"0.275.0",
"0.274.3",
"0.274.2",
"0.274.1",
"0.274.0",
"0.273.3",
"0.273.2",
"0.273.1",
"0.273.0",
"0.272.1",
"0.272.0",
"0.271.2",
"0.271.1",
"0.271.0",
"0.270.6",
"0.270.5",
"0.270.4",
"0.270.3",
"0.270.2",
"0.270.1",
"0.270.0",
"0.269.0",
"0.268.2",
"0.268.1",
"0.268.0",
"0.267.0",
"0.266.1",
"0.266.0",
"0.265.1",
"0.265.0",
"0.264.1",
"0.264.0",
"0.263.2",
"0.263.1",
"0.263.0",
"0.262.6",
"0.262.5",
"0.262.4",
"0.262.3",
"0.262.2",
"0.262.1",
"0.262.0",
"0.261.1",
"0.261.0",
"0.260.4",
"0.260.3",
"0.260.2",
"0.260.1",
"0.260.0",
"0.259.1",
"0.259.0",
"0.258.1",
"0.258.0",
"0.257.0",
"0.256.1",
"0.256.0",
"0.254.1",
"0.255.0",
"0.254.0",
"0.253.1",
"0.253.0",
"0.252.0",
"0.251.0",
"0.250.1",
"0.250.0",
"0.249.0",
"0.248.1",
"0.248.0",
"0.247.2",
"0.247.1",
"0.247.0",
"0.246.3",
"0.246.2",
"0.246.1",
"0.246.0",
"0.245.0",
"0.244.1",
"0.244.0",
"0.243.1",
"0.243.0",
"0.242.0",
"0.241.0",
"0.240.4",
"0.240.3",
"0.240.2",
"0.240.1",
"0.240.0",
"0.239.2",
"0.239.1",
"0.239.0",
"0.238.1",
"0.238.0",
"0.237.3",
"0.237.2",
"0.237.1",
"0.237.0",
"0.236.2",
"0.236.1",
"0.236.0",
"0.235.2",
"0.235.1",
"0.235.0",
"0.234.3",
"0.234.2",
"0.234.1",
"0.234.0",
"0.233.3",
"0.233.2",
"0.233.1",
"0.233.0",
"0.232.2",
"0.232.1",
"0.232.0",
"0.231.1",
"0.231.0",
"0.230.0",
"0.229.2",
"0.229.1",
"0.229.0",
"0.228.0",
"0.227.7",
"0.227.6",
"0.227.5",
"0.227.4",
"0.227.3",
"0.227.2",
"0.227.1",
"0.227.0",
"0.226.2",
"0.226.1",
"0.226.0",
"0.225.1",
"0.225.0",
"0.224.2",
"0.224.1",
"0.224.0",
"0.223.0",
"0.222.0",
"0.221.1",
"0.221.0",
"0.220.0",
"0.219.2",
"0.219.1",
"0.219.0",
"0.218.1",
"0.218.0",
"0.217.1",
"0.217.0",
"0.216.1",
"0.216.0",
"0.215.3",
"0.215.2",
"0.215.1",
"0.215.0",
"0.214.0",
"0.213.0",
"0.212.0",
"0.211.2",
"0.211.1",
"0.211.0",
"0.210.0",
"0.209.8",
"0.209.7",
"0.209.6",
"0.209.5",
"0.209.4",
"0.209.3",
"0.209.2",
"0.209.1",
"0.209.0",
"0.208.3",
"0.208.2",
"0.208.1",
"0.208.0",
"0.207.1",
"0.207.0",
"0.206.0",
"0.205.0",
"0.204.0",
"0.203.3",
"0.203.2",
"0.203.1",
"0.203.0",
"0.202.1",
"0.202.0",
"0.201.1",
"0.201.0",
"0.200.0",
"0.199.3",
"0.199.2",
"0.199.1",
"0.199.0",
"0.198.0",
"0.197.0",
"0.196.2",
"0.196.1",
"0.196.0",
"0.195.3",
"0.195.2",
"0.195.1",
"0.195.0",
"0.194.4",
"0.194.3",
"0.194.2",
"0.194.1",
"0.194.0",
"0.193.1",
"0.193.0",
"0.192.2",
"0.192.1",
"0.192.0",
"0.191.0",
"0.190.0",
"0.189.3",
"0.189.2",
"0.189.1",
"0.189.0",
"0.188.0",
"0.187.5",
"0.187.4",
"0.187.3",
"0.187.2",
"0.187.1",
"0.187.0",
"0.186.3",
"0.186.2",
"0.186.1",
"0.186.0",
"0.185.2",
"0.185.1",
"0.185.0",
"0.184.1",
"0.184.0",
"0.183.8",
"0.183.7",
"0.183.6",
"0.183.5",
"0.183.4",
"0.183.3",
"0.183.2",
"0.183.1",
"0.183.0",
"0.182.0",
"0.181.0",
"0.180.5",
"0.180.4",
"0.180.3",
"0.180.2",
"0.180.1",
"0.180.0",
"0.179.0",
"0.178.3",
"0.178.2",
"0.178.1",
"0.178.0",
"0.177.3",
"0.177.2",
"0.177.1",
"0.177.0",
"0.176.4",
"0.176.3",
"0.176.2",
"0.176.1",
"0.176.0",
"0.175.1",
"0.175.0",
"0.174.0",
"0.173.1",
"0.173.0",
"0.172.0",
"0.171.3",
"0.171.2",
"0.171.1",
"0.171.0",
"0.170.0",
"0.169.0",
"0.168.2",
"0.168.1",
"0.168.0",
"0.167.1",
"0.167.0",
"0.166.0",
"0.165.1",
"0.165.0",
"0.164.1",
"0.164.0",
"0.163.2",
"0.163.1",
"0.163.0",
"0.162.0",
"0.161.1",
"0.161.0",
"0.160.0",
"0.159.1",
"0.159.0",
"0.158.2",
"0.158.1",
"0.158.0",
"0.157.0",
"0.156.4",
"0.156.3",
"0.156.2",
"0.156.1",
"0.156.0",
"0.155.4",
"0.155.3",
"0.155.2",
"0.155.1",
"0.155.0",
"0.154.1",
"0.154.0",
"0.153.0",
"0.152.0",
"0.151.3",
"0.151.2",
"0.151.1",
"0.151.0",
"0.150.1",
"0.150.0",
"0.149.2",
"0.149.1",
"0.149.0",
"0.148.0",
"0.147.0",
"0.146.0",
"0.145.0",
"0.144.3",
"0.144.2",
"0.144.1",
"0.144.0",
"0.143.0",
"0.142.3",
"0.142.2",
"0.142.1",
"0.142.0",
"0.141.0",
"0.140.3",
"0.140.2",
"0.140.1",
"0.140.0",
"0.139.0",
"0.138.2",
"0.138.1",
"0.138.0",
"0.137.1",
"0.137.0",
"0.136.0",
"0.135.0",
"0.134.5",
"0.134.4",
"0.134.3",
"0.134.2",
"0.134.1",
"0.134.0",
"0.133.7",
"0.133.6",
"0.133.5",
"0.133.4",
"0.133.3",
"0.133.2",
"0.133.1",
"0.133.0",
"0.132.1",
"0.132.0",
"0.131.5",
"0.131.4",
"0.131.3",
"0.131.2",
"0.131.1",
"0.131.0",
"0.130.4",
"0.130.3",
"0.130.2",
"0.130.1",
"0.130.0",
"0.129.0",
"0.128.0",
"0.127.4",
"0.127.3",
"0.127.2",
"0.127.1",
"0.127.0",
"0.126.2",
"0.126.1",
"0.126.0",
"0.125.1",
"0.125.0",
"0.124.0",
"0.123.3",
"0.123.2",
"0.123.1",
"0.123.0",
"0.122.1",
"0.122.0",
"0.121.1",
"0.121.0",
"0.120.0",
"0.119.2",
"0.119.1",
"0.119.0",
"0.118.2",
"0.118.1",
"0.118.0",
"0.117.1",
"0.117.0",
"0.116.4",
"0.116.3",
"0.116.2",
"0.116.1",
"0.116.0",
"0.115.0",
"0.114.7",
"0.114.6",
"0.114.5",
"0.114.4",
"0.114.3",
"0.114.2",
"0.114.1",
"0.114.0",
"0.113.0",
"0.112.0",
"0.111.2",
"0.111.1",
"0.111.0",
"0.110.0",
"0.109.1",
"0.109.0",
"0.108.3",
"0.108.2",
"0.108.1",
"0.108.0",
"0.107.1",
"0.107.0",
"0.106.3",
"0.106.2",
"0.106.1",
"0.106.0",
"0.105.1",
"0.105.0",
"0.104.4",
"0.104.3",
"0.104.2",
"0.104.1",
"0.104.0",
"0.103.9",
"0.103.8",
"0.103.7",
"0.103.6",
"0.103.5",
"0.103.4",
"0.103.3",
"0.103.2",
"0.103.1",
"0.103.0",
"0.102.3",
"0.102.2",
"0.102.1",
"0.102.0",
"0.101.0",
"0.100.0",
"0.99.3",
"0.99.2",
"0.99.1",
"0.99.0",
"0.98.2",
"0.98.1",
"0.98.0",
"0.97.0",
"0.96.0",
"0.95.5",
"0.95.4",
"0.95.3",
"0.95.2",
"0.95.1",
"0.95.0",
"0.94.0",
"0.93.23",
"0.93.22",
"0.93.21",
"0.93.20",
"0.93.19",
"0.93.18",
"0.93.17",
"0.93.16",
"0.93.15",
"0.93.14",
"0.93.13",
"0.93.12",
"0.93.11",
"0.93.10",
"0.93.9",
"0.93.8",
"0.93.7",
"0.93.6",
"0.93.5",
"0.93.4",
"0.93.3",
"0.93.2",
"0.93.1",
"0.93.0",
"0.92.2",
"0.92.1",
"0.92.0",
"0.91.0",
"0.90.3",
"0.90.2",
"0.90.1",
"0.90.0",
"0.89.2",
"0.89.1",
"0.89.0",
"0.88.0",
"0.87.3",
"0.87.2",
"0.87.1",
"0.87.0",
"0.86.1",
"0.86.0",
"0.85.1",
"0.85.0",
"0.84.4",
"0.84.3",
"0.84.2",
"0.84.1",
"0.84.0",
"0.83.6",
"0.83.5",
"0.83.4",
"0.83.3",
"0.83.2",
"0.83.1",
"0.83.0",
"0.82.2",
"0.82.1",
"0.82.0",
"0.81.0",
"0.80.2",
"0.80.1",
"0.80.0",
"0.79.0",
"0.78.2",
"0.78.1",
"0.78.0",
"0.77.12",
"0.77.11",
"0.77.10",
"0.77.9",
"0.77.8",
"0.77.7",
"0.77.6",
"0.77.5",
"0.77.4",
"0.77.3",
"0.77.2",
"0.77.1",
"0.77.0",
"0.76.1",
"0.76.0",
"0.75.1",
"0.75.0",
"0.74.1",
"0.74.0",
"0.73.9",
"0.73.8",
"0.73.7",
"0.73.6",
"0.73.5",
"0.73.4",
"0.73.3",
"0.73.2",
"0.73.1",
"0.73.0",
"0.72.3",
"0.72.2",
"0.72.1",
"0.72.0",
"0.71.3",
"0.71.2",
"0.71.1",
"0.71.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47706.json"
}
}
],
"modified": "2026-10-28T02:30:46.369011253Z",
"provider": "osv",
"references": [
"https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47706.json",
"https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-qfwv-87qj-98xq",
"https://nvd.nist.gov/vuln/detail/CVE-2026-47706"
],
"provider_metadata": {
"cwe_ids": [
"CWE-400",
"CWE-674"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47706.json"
}
},
"related_cves": [
{
"value": "CVE-2026-47706",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 514214,
"published_at": "2026-06-04T14:06:48.22+00:00"
}