The vulnerability resides in the legacy graphql‑ws subscription handler of the Strawberry GraphQL library. Versions 0.312.3 through 0.327.1 fail to clear completed subscription entries from internal tracking structures. When a client connects over a persistent WebSocket and performs one‑shot subscriptions using distinct operation identifiers, these entries occupy the configured maximum subscription slots even after the subscriptions have terminated. As a result, further legitimate subscription requests are rejected with a “Subscription limit reached” error, effectively denying service to otherwise valid clients. This problem is a classic example of uncontrolled resource consumption (CWE‑400) and limits fulfillment of the API contract.

Affected systems are installations of the strawberry‑graphql Python library version 0.312.3 up to 0.327.1 that use the legacy graphql‑ws protocol. The modern graphql‑transport‑ws protocol and any deployments that do not impose a per‑connection subscription cap are not impacted by this issue.

CVSS score of 3.7 indicates low to moderate severity. Explorers can easily trigger the condition by maintaining a client connection and repeatedly deploying unique subscription operations until the configured slot count is exhausted. Because the attack surface exists on the application layer and requires only WebSocket activity, the likelihood of exploitation is high for targeted services that rely on legacy subscription handling with subscription limits enabled. The vulnerability is not currently listed in the CISA catalog of known exploited vulnerabilities, and no EPSS score is reported, but the scenario outlined makes it a practical denial‑of‑service risk for exposed APIs. Upgrading to 0.327.2 or later removes this risk.