strawberry-graphql 0.312.1

Direct Vulnerabilities

Known vulnerabilities in the strawberry-graphql package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the WebSocket subscription handling process. An attacker can exhaust server resources by sending a large number of subscribe messages with unique IDs over a single connection, causing unbounded allocation of `asyncio.Task` objects and leading to memory exhaustion and event loop saturation. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `strawberry-graphql` to version 0.312.3 or higher.	[,0.312.3)
H Missing Authentication for Critical Function strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the `on_ws_connect` process. An attacker can gain unauthorized access to WebSocket subscription endpoints by connecting with the legacy graphql-ws subprotocol and sending a start message directly, bypassing the required authentication handshake. Note: This is only exploitable if the application relies on `on_ws_connect` for authentication or authorization. How to fix Missing Authentication for Critical Function? Upgrade `strawberry-graphql` to version 0.312.3 or higher.	[,0.312.3)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

strawberry-graphql is an A library for creating GraphQL APIs

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the WebSocket subscription handling process. An attacker can exhaust server resources by sending a large number of subscribe messages with unique IDs over a single connection, causing unbounded allocation of asyncio.Task objects and leading to memory exhaustion and event loop saturation.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade strawberry-graphql to version 0.312.3 or higher.

[,0.312.3)

Missing Authentication for Critical Function

strawberry-graphql is an A library for creating GraphQL APIs

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the on_ws_connect process. An attacker can gain unauthorized access to WebSocket subscription endpoints by connecting with the legacy graphql-ws subprotocol and sending a start message directly, bypassing the required authentication handshake.

Note:

This is only exploitable if the application relies on on_ws_connect for authentication or authorization.

How to fix Missing Authentication for Critical Function?

Upgrade strawberry-graphql to version 0.312.3 or higher.

[,0.312.3)

strawberry-graphql@0.312.1

A library for creating GraphQL APIs

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically