CVE-2026-59286

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9.

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, 1.1.0-1.3.9, and 1.0.0-1.0.7.

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.3.0-1.3.9.

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Affects versions 2.0.0 - 2.0.4.

Vulnerability in Spring GraphQL causes the @Controller annotation detection mechanism to incorrectly resolve annotations in type hierarchies. This can lead to security annotations being ignored at runtime.

Cross-Site WebSocket Hijacking vulnerability in Spring for GraphQL with WebSocket transport enabled. An attacker can trick an authenticated user into visiting a malicious page, allowing arbitrary GraphQL operations with the victim's credentials.

Spring for GraphQL is vulnerable to unsafe deserialization when processing paginated GraphQL queries. An attacker can craft a malicious request leading to Remote Code Execution (RCE) if the application exposes a Connection field and the classpath contains specific classes.