« Volver al listado

CVE-2026-107727

Estado: Pendiente de análisisBaja (3.7)—

Strawberry GraphQL es una biblioteca para crear API GraphQL. Desde la 0.312.3 hasta la 0.327.2, el manejador de suscripciones heredado graphql-ws en strawberry/subscriptions/protocols/graphql_ws/handlers.py no elimina las operaciones completadas de forma natural de self.tasks y self.subscriptions.

Leer descripción completaMostrar menos

Cuando se configura max_subscriptions_per_connection, un cliente en una conexión WebSocket persistente puede usar identificadores de operación distintos para suscripciones de un solo uso para llenar las plazas configuradas de la conexión incluso después de que esas suscripciones envíen complete, haciendo que las operaciones legítimas posteriores en esa conexión se rechacen con Subscription limit reached. El protocolo moderno graphql-transport-ws y los despliegues sin el límite por conexión configurado no están afectados. Este problema está corregido en la versión 0.327.2.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Strawberry — Strawberry GraphqlAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-107727",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107727",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-13T16:27:02.885735Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "strawberry-graphql",
          "product": "strawberry",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.312.3, < 0.327.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-08T23:16:58.010",
  "references": [
    {
      "url": "https://github.com/strawberry-graphql/strawberry/commit/24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/strawberry-graphql/strawberry/pull/4610",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/strawberry-graphql/strawberry/releases/tag/0.327.2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2."
    }
  ],
  "lastModified": "2026-10-13T17:17:17.093",
  "sourceIdentifier": "security-advisories@github.com"
}