CVE-2026-35526: 
Python vulnerability analysis and mitigation

CVE-2026-35526 is a Denial of Service vulnerability in Strawberry GraphQL (strawberry-graphql) caused by unbounded WebSocket subscription handling. The library's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols fail to enforce any limit on the number of active subscriptions per connection, allowing an unauthenticated attacker to exhaust server memory and saturate the event loop. All versions up to and including 0.312.2 are affected; the vulnerability was fixed in version 0.312.3. It was first published on April 4, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Strawberry Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). For every incoming subscribe message received over a WebSocket connection, the server unconditionally allocates a new asyncio.Task and an associated Operation object along with an async generator — with no cap on how many can be created per connection. An attacker requires no authentication or special privileges; they need only establish a single WebSocket connection, send a connection_init message, and then continuously send subscribe messages with unique IDs. This causes linear memory growth proportional to the number of subscribe messages sent, eventually saturating the Python asyncio event loop and exhausting available memory (Github Advisory, Strawberry Advisory).

Successful exploitation results exclusively in an availability impact — there is no confidentiality or integrity compromise. An attacker can cause progressive server degradation, severe performance loss, or an out-of-memory (OOM) crash that renders the GraphQL API service completely unavailable. Because the attack requires only a single WebSocket connection and no credentials, it can be executed with minimal resources and may affect all users of the targeted service simultaneously (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.044% (0.000440), placing it in the 21st percentile for exploitation probability within 30 days. Despite the low EPSS, the attack requires no authentication, no user interaction, and low complexity, making it straightforward to exploit if targeted (Github Advisory).

1. Reconnaissance: Identify internet-facing services running Strawberry GraphQL with WebSocket subscriptions enabled (versions ≤ 0.312.2) using tools like Shodan or Censys, searching for GraphQL WebSocket endpoints.
2. Establish WebSocket connection: Connect to the target's GraphQL WebSocket endpoint (e.g., ws://target/graphql) using a WebSocket client or scripting library such as Python's websockets.
3. Send connection_init: Transmit the protocol initialization message to complete the WebSocket handshake: {"type": "connection_init"}.
4. Flood subscribe messages: Rapidly send a large volume of subscribe messages, each with a unique ID and a valid (or minimal) GraphQL subscription query, e.g., {"id": "<unique_id>", "type": "subscribe", "payload": {"query": "subscription { someField }"}}. Automate this in a loop to maximize throughput.
5. Achieve DoS: Each message causes the server to spawn a new asyncio.Task and async generator without limit. As tasks accumulate, server memory grows linearly and the event loop becomes saturated, leading to degraded performance or an OOM crash (Github Advisory, Strawberry Advisory).

• Network: Unusually high volume of WebSocket subscribe messages from a single client IP to the GraphQL endpoint; sustained long-lived WebSocket connections with rapid message throughput.
• Logs: Application logs showing a rapidly growing number of active subscription tasks or Operation objects; error messages related to memory exhaustion or asyncio event loop overload in the server logs.
• Process: Python process (serving Strawberry GraphQL) exhibiting linear memory growth over time; high CPU utilization on the asyncio event loop thread; OOM killer events in system logs (dmesg or /var/log/syslog) referencing the Python process.
• Application Metrics: Sudden spike in active WebSocket subscription count without a corresponding increase in legitimate user activity; degraded API response times correlating with subscription message floods.

The primary remediation is to upgrade strawberry-graphql to version 0.312.3 or later, which enforces limits on active subscriptions per WebSocket connection (Github Advisory). The fix is referenced in commit 0977a4e and the official release at strawberry-graphql/strawberry v0.312.3. As interim workarounds prior to patching, operators should implement rate limiting and throttling on WebSocket connections at the reverse proxy or API gateway layer, enforce per-connection subscription quotas, and monitor event loop health and memory usage for anomalies. Restricting WebSocket access to authenticated users where possible will also reduce the attack surface (Feedly).

The vulnerability was reported by security researcher JFOZ1010 and coordinated by Strawberry GraphQL maintainers patrick91 and bellini666, who published the advisory on April 4, 2026 (Strawberry Advisory). The advisory was reviewed and published to the GitHub Advisory Database on April 6, 2026, and subsequently picked up by NVD, Red Hat, and several vulnerability tracking platforms. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability disclosure channels.