CVE-2026-47706

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.71.0 through 0.315.6

Description The QueryDepthLimiter extension is susceptible to an application-level Denial of Service (DoS). This occurs because the determine depth() function in query depth limiter.py lacks cycle detection when resolving fragment spreads. If a query contains circular fragment references, the function enters an infinite recursion, resulting in a RecursionError that crashes the validation process. This allows an attacker to exhaust server CPU cycles and thread or worker pools since validation occurs before query execution.

Recommendations Update to version 0.315.7.