Most recent entries from all

EUVD-2026-324639

fkie_cve-2026-47707

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion. Version 0.315.7 contains a fix for the issue.

GHSA-fr49-mhgj-crfc — Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Affected: PyPI: strawberry-graphql

### Summary The MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion.

### Details The current implementation of alias counting in strawberry/extensions/max_aliases.py uses a static approach ``` for selection in selection_set_owner.selection_set.selections: if isinstance(selection, FieldNode) and selection.alias: result += 1

if isinstance(selection, (FieldNode, InlineFragmentNode)) and ~~~: result += count_fields_with_alias(selection) ```

When a FragmentSpread is used multiple times, the actual number of aliases processed by the execution engine is

**Total Aliases = query aliases + (num of spreads * aliases within fragment)**

Because Strawberry only performs a static sum of the text, it misses this multiplication

### PoC **server code** ``` import strawberry from fastapi import FastAPI from strawberry.fastapi import GraphQLRouter from strawberry.extensions import MaxAliasesLimiter

@strawberry.type class User: name: str = "GONA"

@strawberry.type class Query: @strawberry.field def user(self) -> User: return Us…

PYSEC-2026-2284

Affected: PyPI: strawberry-graphql