ROOT-APP-MAVEN-CVE-2026-41856 CVE-2026-41856 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41856 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41700 CVE-2026-41700 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41700 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41699 CVE-2026-41699 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41699 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1789373257 TuxCare security update for org.springframework.graphql (4 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 4 CVEs. Fixed in 1.0.6-tuxcare.6...

CLSA-2026-1789369685 TuxCare security update for org.springframework.graphql (1 CVE)

TuxCare rebuilt 2 org.springframework.graphql packages to address 1 CVE. Fixed in 1.2.9-tuxcare.6...

CLSA-2026-1789149911 TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.3.5-tuxcare.4...

CLSA-2026-1788870312 TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.3.5-tuxcare.3...

CLSA-2026-1788806164 TuxCare security update for org.springframework.graphql (3 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 3 CVEs. Fixed in 1.4.6-tuxcare.1...

CLSA-2026-1788410329 TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1...

com.apollographql.federation:federation-spring-subscription-callback (>=6.0.0, <=7.0.0), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0, <=4.0.2) +55 more potentially affected by CVE-2026-59289 via org.springframework.graphql:spring-graphql (>=2.0.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0, =6.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter 1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources 1.4.0 -...

com.apollographql.federation:federation-spring-subscription-callback (>=6.0.0, <=7.0.0), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0, <=4.0.2) +55 more potentially affected by CVE-2026-59288 via org.springframework.graphql:spring-graphql (>=2.0.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0, =6.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter 1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources 1.4.0 -...

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=7.0.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +128 more potentially affected by CVE-2026-59289 via org.springframework.graphql:spring-graphql (>=1.2.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =1.2.0, =4.2.0, =2.0.0.release, =1.0.1, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =1.1.0, =1.1.0, =1.4.0 and more Source cves: CVE-2026-59289https://vul...

Cross-site Request Forgery (CSRF)

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active sessio...

Unsafe Dependency Resolution

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the GraphiQL. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising t...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocketGraphQlClient when the keepAlive option is enabled and an attacker is able to...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pagination support. An attacker can exhaust application memory or place significant,...

Deserialization of Untrusted Data

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...

com.apollographql.federation:federation-spring-subscription-callback (>=6.0.0, <=7.0.0), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0, <=4.0.2) +55 more potentially affected by CVE-2026-59285 via org.springframework.graphql:spring-graphql (>=2.0.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0, =6.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter 1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources 1.4.0 -...

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=7.0.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +155 more potentially affected by CVE-2026-59286 via org.springframework.graphql:spring-graphql (>=1.0.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.release, =1.0.1, =4.0, =2.0rc1, =2.0rc1, =4.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1,...

com.apollographql.federation:federation-spring-subscription-callback (>=5.1.0, <=7.0.0), com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2) +117 more potentially affected by CVE-2026-59287 via org.springframework.graphql:spring-graphql (>=1.3.0, <=2.0.4)

org.springframework.graphql:spring-graphql MAVEN version =1.3.0, =5.1.0, =1.0.1, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =3.0, =3.0, =4.0, =4.0, =1.2.8, =1.2.8, =1.2.8, =1.4.0 and more Source cves: CVE-2026-59287htt...