ROOT-APP-MAVEN-CVE-2026-41700 CVE-2026-41700 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41700 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41856 CVE-2026-41856 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41856 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41699 CVE-2026-41699 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41699 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1789373257 TuxCare security update for org.springframework.graphql (4 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 4 CVEs. Fixed in 1.0.6-tuxcare.6...

CLSA-2026-1789369685 TuxCare security update for org.springframework.graphql (1 CVE)

TuxCare rebuilt 2 org.springframework.graphql packages to address 1 CVE. Fixed in 1.2.9-tuxcare.6...

CLSA-2026-1789149911 TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.3.5-tuxcare.4...

CLSA-2026-1788870312 TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.3.5-tuxcare.3...

CLSA-2026-1788806164 TuxCare security update for org.springframework.graphql (3 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 3 CVEs. Fixed in 1.4.6-tuxcare.1...

CLSA-2026-1788410329 TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1...

Deserialization of Untrusted Data

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...

Unsafe Dependency Resolution

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the GraphiQL. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising t...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pagination support. An attacker can exhaust application memory or place significant,...

Cross-site Request Forgery (CSRF)

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active sessio...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocketGraphQlClient when the keepAlive option is enabled and an attacker is able to...

Incorrect Authorization

org.springframework.graphql:spring-graphql is vulnerable to Improper Authorization. The vulnerability is due to incorrect resolution of security annotations on @Controller data fetcher methods within type hierarchies, which allows an attacker to bypass authorization checks when security annotatio...

Unsafe Deserialization

org.springframework.graphql, spring-graphql is vulnerable to Unsafe Deserialization. The vulnerability is due to unsafe deserialization of data when processing paginated GraphQL queries, which allows an attacker to craft a malicious GraphQL request and potentially achieve Remote Code Execution RC...

K000162466: Spring GraphQL vulnerability CVE-2026-41856

Security Advisory Description The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met,...

This Week in Spring - June 16th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! I'm writing this from the oh-so-delightful and delicious! city of New Delhi, India. It's been a real privilege to come and visit so many amazing people. Last night my friend DaShaun and I presented here at the local Delhi JUG,...

CVE-2026-41856

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

CVE-2026-41856 Spring GraphQL Annotation Detection Vulnerability

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...