CVE-2026-47706: Strawberry GraphQL has a Circular Fragment Reference DOS

June 4, 2026 (updated June 9, 2026)

The QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process.

References

github.com/advisories/GHSA-qfwv-87qj-98xq
github.com/strawberry-graphql/strawberry/releases/tag/0.315.7
github.com/strawberry-graphql/strawberry/security/advisories/GHSA-qfwv-87qj-98xq
nvd.nist.gov/vuln/detail/CVE-2026-47706

Code Behaviors & Features

Detect and mitigate CVE-2026-47706 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →