The MaxAliasesLimiter extension in strawberry-graphql does not correctly account for the amplification effect of fragment spreads in GraphQL queries. A malicious query can therefore bypass the configured alias limit and force the server to resolve and render a far larger number of aliases than intended, leading to excessive CPU and memory usage. This can cause a denial of service by exhausting server resources.

Affected products are the strawberry-graphql Python library, versions from 0.172.0 up to and including 0.315.6. Users running any of these releases that use the MaxAliasesLimiter extension are vulnerable. The issue is fixed in 0.315.7 and later releases.

The CVSS score is 5.3, classifying the vulnerability as medium severity. No EPSS score is available, and it is not listed in the CISA KEV catalog, suggesting no publicly known exploits at the time of publication. The vulnerability is likely exploitable via a crafted GraphQL query sent to the server over HTTP, where the attacker provides a query containing many fragment spreads that multiply the alias count beyond the limit. The exploit requires the MaxAliasesLimiter to be enabled.