Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.6.0 Vulnerability Details CVEID:CVE-2026-59278 DESCRIPTION: JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include...

CLSA-2026-1788873403 TuxCare security update for org.springframework.graphql (5 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 5 CVEs. Fixed in 1.2.9-tuxcare.5...

Denial Of Service

Spring for GraphQL is vulnerable to Denial of Service. The vulnerability is due to improper validation of pagination arguments in the Spring Data pagination support, where client‑supplied values are passed to the underlying repository and an attacker can forge a malicious query for a Connection...

Cross-Site Request Forgery (CSRF)

Spring for GraphQL is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the GraphiQL page allowing attacker-controlled URLs to trigger requests to application GraphQL endpoints, potentially causing confidential information to be leaked to the attacker's website...

Denial Of Service

Spring for GraphQL is vulnerable to Denial of Service. The vulnerability is due to improper handling of the WebSocket client keepAlive feature, where the client maintains persistent connections without adequate limits and an attacker can trigger excessive resource consumption to cause a denial of...

Integrity Check Bypass

Spring for GraphQL is vulnerable to an integrity check bypass. The vulnerability is due to loading JavaScript libraries from a public CDN without Subresource Integrity checks, where an attacker can inject malicious code into those scripts and execute arbitrary code on the browser loading the...

Unsafe Deserialization

Spring for GraphQL is vulnerable to Unsafe Deserialization. The vulnerability is due to unsafe deserialization of paginated GraphQL query data, where crafted serialized objects can be supplied and deserialized without proper validation, allowing attackers to execute arbitrary code...

CVE-2026-59288

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

CVE-2026-59289

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

CVE-2026-59287

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9...

CVE-2026-59285

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4...

CVE-2026-59286

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

CVE-2026-59289 Spring for GraphQL Denial of Service via pagination support

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

CVE-2026-59289

CVE-2026-59289 affects Spring for GraphQL (versions 2.0.0–2.0.4, 1.4.0–1.4.6, 1.2.0–1.3.9) through a Denial of Service in its Spring Data pagination support. The root cause is that scrollable query arguments are resolved from client-supplied values and forwarded directly to the underlying reposit...

CVE-2026-59289 Spring for GraphQL Denial of Service via pagination support

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

EUVD-2026-67178

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

CVE-2026-59288 Spring for GraphQL Information Exposure in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

EUVD-2026-67177

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

CVE-2026-59288

Spring for GraphQL (org.springframework.graphql:spring-graphql) versions 2.0.0–2.0.4 , 1.4.0–1.4.6 , 1.1.0–1.3.9 , and 1.0.0–1.0.7 are vulnerable to a Cross-Site Request Forgery (CSRF) issue via the bundled GraphiQL page. An attacker can share a malicious URL that, when visited by a user with an ...

CVE-2026-59288 Spring for GraphQL Information Exposure in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...