PyPI/strawberry-graphql CVE-2026-107727: low 3.7, EPSS 0.35%

Strawberry legacy graphql-ws retains naturally completed subscription slots

Action: Upgrade strawberry-graphql to 0.327.2 or later.

pip install strawberry-graphql==0.327.2

Affected

Fixed versions

Sources

• osv: GHSA-m952-2w3f-6r8h
• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h
• https://nvd.nist.gov/vuln/detail/CVE-2026-107727
• https://github.com/strawberry-graphql/strawberry/pull/4610
• https://github.com/strawberry-graphql/strawberry/commit/24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92
• https://github.com/strawberry-graphql/strawberry
• https://github.com/strawberry-graphql/strawberry/releases/tag/0.327.2

CVE-2026-107727 · published 2026-10-09T14:07:20Z · modified 2026-10-15T14:56:15.602466847Z · JSON