https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-47707.htmlhttps://patchthecve.com/cve/CVE-2026-47707.htmlWed, 22 Jul 2026 20:10:00 +0000MEDIUM 5.3: Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not considehttps://patchthecve.com/cve/CVE-2026-47706.htmlhttps://patchthecve.com/cve/CVE-2026-47706.htmlWed, 22 Jul 2026 20:10:00 +0000MEDIUM 5.3: Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth functihttps://patchthecve.com/cve/CVE-2026-45739.htmlhttps://patchthecve.com/cve/CVE-2026-45739.htmlWed, 22 Jul 2026 20:10:00 +0000LOW 3.1: Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as `Authorization: Bearer <token>`, the v