CVE-2026-59289
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9.
Risk Assessment
An attacker can cause application unavailability by exhausting memory or overloading the database, potentially leading to service disruptions.
Recommendation
Update Spring for GraphQL to the latest patched version and implement query limits and argument validation.
Other vulnerabilities in Spring for GraphQL
See all- CVE-2026-59288High
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, 1.1.0-1.3.9, and 1.0.0-1.0.7.
- CVE-2026-59287Medium
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.3.0-1.3.9.
- CVE-2026-59286High
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, 1.1.0-1.3.9, and 1.0.0-1.0.7.
- CVE-2026-59285High
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Affects versions 2.0.0 - 2.0.4.
- CVE-2026-41856High
Vulnerability in Spring GraphQL causes the @Controller annotation detection mechanism to incorrectly resolve annotations in type hierarchies. This can lead to security annotations being ignored at runtime.
- CVE-2026-41700High
Cross-Site WebSocket Hijacking vulnerability in Spring for GraphQL with WebSocket transport enabled. An attacker can trick an authenticated user into visiting a malicious page, allowing arbitrary GraphQL operations with the victim's credentials.
- CVE-2026-41699High
Spring for GraphQL is vulnerable to unsafe deserialization when processing paginated GraphQL queries. An attacker can craft a malicious request leading to Remote Code Execution (RCE) if the application exposes a Connection field and the classpath contains specific classes.
Original NVD description (English source)
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9
Vulnerability data from NVD (NIST) · CISA KEV · EPSS