The QueryDepthLimiter extension of Strawberry GraphQL does not detect circular fragment references in a query. When a client submits a query containing a cycle, the internal depth calculation recurses without end, raising a RecursionError that terminates the validation stage, effectively crashing the server and rendering the API unavailable.

The vulnerability affects the Strawberry GraphQL Python library in all releases from 0.71.0 up to and including 0.315.6. Any application using these versions as a dependency is at risk.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available and the issue is not listed in CISA’s KEV catalog. The likely attack vector is from any external client that can send GraphQL queries, making this a remote denial‑of‑service scenario that can be triggered simply by constructing a query with a circular fragment reference. Successful exploitation would interrupt service for all users.