An unauthenticated resource exhaustion vulnerability in Strawberry GraphQL allows remote attackers to cause server instability or crashes via uncontrolled WebSocket subscription requests.

The vulnerability exists in the WebSocket subscription handlers for graphql-transport-ws and graphql-ws protocols, where the library fails to enforce limits on the number of active subscriptions per connection. An unauthenticated attacker can flood the server with subscribe messages, causing linear memory growth and event loop saturation.

The exploitation of this vulnerability leads to a denial of service (DoS) condition, potentially resulting in complete system downtime for applications relying on the affected GraphQL API. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability and operational continuity, as it allows an unauthenticated actor to crash the service with minimal effort.

Immediate Action: Update the Strawberry GraphQL library to version 0.312.3 or later to implement necessary resource constraints on WebSocket subscriptions.

Proactive Monitoring: Monitor server memory utilization and WebSocket connection logs for patterns of rapid, repetitive subscription initiation that deviate from normal traffic profiles.

Compensating Controls: Implement WebSocket rate limiting at the load balancer or application gateway level to restrict the number of incoming messages and concurrent connections from a single IP address.

Public Exploit Available: No (No confirmed public exploit exists in the available data).

Given the ease with which an unauthenticated attacker can trigger a denial-of-service state, it is critical that organizations using Strawberry GraphQL prioritize this update. Administrators should verify their current library version and apply the patch immediately to prevent potential service disruptions.