The vulnerability resides in Strawberry GraphQL’s WebSocket subscription handling, where each subscription message creates a new asyncio.Task and an Operation object without any cap on concurrent tasks. This unbounded allocation leads to linear memory growth and event loop saturation, eventually causing the server to degrade, become unresponsive, or crash with an out‑of‑memory condition. The weakness matches CWE‑770, reflecting an uncontrolled resource consumption flaw.

The affected product is the Strawberry GraphQL library, used to build GraphQL APIs, when used in versions prior to 0.312.3. Users of the library in any environment—be it web, mobile, or microservice—are potentially impacted if they rely on the default WebSocket subscription implementation.

The CVSS score of 7.5 indicates a high severity. No EPSS score is available, and the vulnerability has not been listed in the CISA KEV catalog. The attack can be carried out by an unauthenticated adversary who opens a single WebSocket connection, sends connection_init, and floods the server with subscribe messages carrying unique IDs. Because each message spawns a new asynchronous generator, the server’s memory continues to increase, eventually exhausting resources and leading to a denial of service. The absence of a limiting mechanism makes exploitation straightforward and highly likely when the vulnerable version is in use.