Ghostwire

CVE-2026-107727: Strawberry legacy graphql-ws retains naturally completed subscription slots

LOW CVSS 3.7 EPSS 0.35% Exploit Available 2 PoC

Published: October 9, 2026 | Last Modified: October 9, 2026

Description

Strawberry legacy graphql-ws retains naturally completed subscription slots

Ghostwire Analysis — What This Means Practically

Exploitation Probability (EPSS): Low — 0.35% (27th percentile)

Low exploitation probability based on current threat landscape data. Standard patching timeline is appropriate.

2 proof-of-concept exploits available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Proof-of-Concept Exploits (2)

strawberry-graphql/strawberry
strawberry-graphql/strawberry

Security Coverage (1 articles)

References

github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h
nvd.nist.gov/vuln/detail/CVE-2026-107727
github.com/strawberry-graphql/strawberry/pull/4610
github.com/strawberry-graphql/strawberry/commit/24c5e46d57f7ad4f77e6e01fb8ae482d
github.com/strawberry-graphql/strawberry/releases/tag/0.327.2
github.com/advisories/GHSA-m952-2w3f-6r8h
www.tenable.com/cve/CVE-2026-107727
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-107727