BSD Portspy-strawberry-graphql -- Multiple vulnerabilities
· CVE-2026-35523, CVE-2026-35526 · VuXML entry
The Strawberry GraphQL project reports: Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a 'connection_init' handshake has been completed before processing start (subscription) messages. This allows a remote attacker to skip the 'on_ws_connect' authentication hook entirely by connecting …
Affected versions
- py310-strawberry-graphql, py311-strawberry-graphql, py312-strawberry-graphql, py313-strawberry-graphql, py313t-strawberry-graphql, py314-strawberry-graphql < 0.312.3
- py310-dj52-strawberry-graphql, py311-dj52-strawberry-graphql, py312-dj52-strawberry-graphql, py313-dj52-strawberry-graphql, py313t-dj52-strawberry-graphql, py314-dj52-strawberry-graphql < 0.312.3
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | devel/py-strawberry-graphql | 0.262.5 | vulnerable since 2026-04-17 | |
| MidnightBSD | devel/py-strawberry-graphql | 0.320.0_1 | out of range, by version | |
| FreeBSD | devel/py-strawberry-graphql | 0.327.3 | fixed | (89 days after) |