python · strawberry-graphqlHeads-up
strawberry-graphql QueryDepthLimiter DoS via circular fragment spreads
The QueryDepthLimiter extension lacks cycle detection in fragment spreads.
What changed
The QueryDepthLimiter extension lacks cycle detection in fragment spreads. The determine_depth function recursively resolves FragmentSpreadNode without tracking visited fragments, enabling infinite recursion on circular references.
Who it affects
Users of strawberry-graphql who use the QueryDepthLimiter extension.
What to do today
Update to a patched version of strawberry-graphql that adds cycle detection in determine_depth, or disable QueryDepthLimiter until a patch is available.
The trail
Collected→
Audited→
Written→
Published