Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-qfwv-87qj-98xq, is an application-level denial-of-service in the Strawberry GraphQL library. The root cause is uncontrolled recursion in two separate validation extensions: QueryDepthLimiter and MaxAliasesLimiter. The core issue lies in the determine_depth and count_fields_with_alias functions, respectively. Both functions recursively traverse a GraphQL query's structure but failed to track which fragments had already been processed in a given path. An attacker can craft a GraphQL query with circular fragment references (e.g., fragment A spreads fragment B, and fragment B spreads fragment A). When the vulnerable functions encounter this structure, they enter an infinite recursive loop, which ultimately exhausts the call stack and crashes the Python process with a RecursionError. This can be triggered by a simple, unauthenticated request, making it an effective DoS vector. The analysis of the fixing commits, particularly 8c5007dae4dfe994fca310b1f37fa0d75d2aa7e4, clearly shows the introduction of a visited_fragments set in both functions. This set is used to keep track of processed fragments during recursion, immediately stopping the process if a cycle is detected, thus mitigating the vulnerability.
determine_depthstrawberry/extensions/query_depth_limiter.py
count_fields_with_aliasstrawberry/extensions/max_aliases.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| strawberry-graphql | pip | >= 0.71.0, <= 0.315.6 | 0.315.7 |