CVE-2026-59288

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

CVE-2026-59289

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

CVE-2026-59287

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9...

CVE-2026-59285

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4...

CVE-2026-59286

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

CVE-2026-59289

CVE-2026-59289 affects Spring for GraphQL (versions 2.0.0–2.0.4, 1.4.0–1.4.6, 1.2.0–1.3.9) through a Denial of Service in its Spring Data pagination support. The root cause is that scrollable query arguments are resolved from client-supplied values and forwarded directly to the underlying reposit...

EUVD-2026-67178

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

EUVD-2026-67177

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

CVE-2026-59288

Spring for GraphQL (org.springframework.graphql:spring-graphql) versions 2.0.0–2.0.4 , 1.4.0–1.4.6 , 1.1.0–1.3.9 , and 1.0.0–1.0.7 are vulnerable to a Cross-Site Request Forgery (CSRF) issue via the bundled GraphiQL page. An attacker can share a malicious URL that, when visited by a user with an ...

CVE-2026-59288 Spring for GraphQL Information Exposure in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

EUVD-2026-67176

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9...

CVE-2026-59287

Spring for GraphQL versions 2.0.0–2.0.4, 1.4.0–1.4.6, and 1.3.0–1.3.9 are vulnerable to Denial of Service through the WebSocketGraphQlClient when the keepAlive option is enabled. An attacker who can interfere with the WebSocket connection—either by controlling the GraphQL server or via a Man-in-t...

EUVD-2026-67175

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

CVE-2026-59286

Spring for GraphQL (versions 2.0.0–2.0.4, 1.4.0–1.4.6, 1.1.0–1.3.9, and 1.0.0–1.0.7) is affected by an unsafe dependency resolution issue in its bundled GraphiQL page, which loads JavaScript libraries from a public CDN without Subresource Integrity checks. An attacker who compromises the CDN or i...

CVE-2026-59285

Spring for GraphQL (versions 2.0.0–2.0.4 ) is vulnerable to Unsafe Deserialization (CWE-502) when processing paginated GraphQL queries. The root cause lies in the deserialization of untrusted data via Jackson 2.x when handling a Connection (pagination) field . An attacker can execute arbitrary co...

EUVD-2026-67174

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4...

CVE-2026-59289

CVE-2026-59289...

K000162177: Spring Framework vulnerability CVE-2026-41699

Security Advisory Description Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated Connection field and...

CVE-2026-41699

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated Connection field and the classpath contains specifi...

CVE-2026-41700

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials...