CVE-2026-107727Published
Strawberry legacy graphql-ws retains naturally completed subscription slots
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107727 · Microsoft / collected KEV context
cve-program · CVE-2026-107727
- https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h
- https://github.com/strawberry-graphql/strawberry/pull/4610
- https://github.com/strawberry-graphql/strawberry/commit/24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92
- https://github.com/strawberry-graphql/strawberry/releases/tag/0.327.2
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.