CVE-2026-41856

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9.

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, 1.1.0-1.3.9, and 1.0.0-1.0.7.

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.3.0-1.3.9.

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, 1.1.0-1.3.9, and 1.0.0-1.0.7.

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Affects versions 2.0.0 - 2.0.4.

Cross-Site WebSocket Hijacking vulnerability in Spring for GraphQL with WebSocket transport enabled. An attacker can trick an authenticated user into visiting a malicious page, allowing arbitrary GraphQL operations with the victim's credentials.

Spring for GraphQL is vulnerable to unsafe deserialization when processing paginated GraphQL queries. An attacker can craft a malicious request leading to Remote Code Execution (RCE) if the application exposes a Connection field and the classpath contains specific classes.