Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-59289 (GCVE-0-2026-59289)

Vulnerability from nvd – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL Denial of Service via pagination support

Summary

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9

Severity

No CVSS data available.

CWE

CWE-770 Allocation of Resources Without Limits or Throttling

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59289

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom) Affected: 1.4.0 , ≤ 1.4.6 (custom) Affected: 1.2.0 , ≤ 1.3.9 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.3.9",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring for GraphQL\u0027s Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003cbr/\u003eSpring for GraphQL 1.4.0 - 1.4.6\u003cbr/\u003eSpring for GraphQL 1.2.0 - 1.3.9\u003c/p\u003e"
            }
          ],
          "value": "Spring for GraphQL\u0027s Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.2.0 - 1.3.9"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring for GraphQL\u0027s Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:47.944Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59289"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL Denial of Service via pagination support"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59289",
    "datePublished": "2026-08-27T17:57:47.944Z",
    "dateReserved": "2026-07-04T18:13:34.323Z",
    "dateUpdated": "2026-08-27T17:57:47.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59288 (GCVE-0-2026-59288)

Vulnerability from nvd – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL Information Exposure in GraphiQL support

Summary

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

Severity

No CVSS data available.

CWE

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59288

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom) Affected: 1.4.0 , ≤ 1.4.6 (custom) Affected: 1.1.0 , ≤ 1.3.9 (custom) Affected: 1.0.0 , ≤ 1.0.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.3.9",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim\u0027s browser might leak confidential information to the attacker\u0027s website.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003cbr/\u003eSpring for GraphQL 1.4.0 - 1.4.6\u003cbr/\u003eSpring for GraphQL 1.1.0 - 1.3.9\u003cbr/\u003eSpring for GraphQL 1.0.0 - 1.0.7\u003c/p\u003e"
            }
          ],
          "value": "The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim\u0027s browser might leak confidential information to the attacker\u0027s website.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.1.0 - 1.3.9\nSpring for GraphQL 1.0.0 - 1.0.7"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim\u0027s browser might leak confidential information to the attacker\u0027s website."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:46.990Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59288"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL Information Exposure in GraphiQL support"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59288",
    "datePublished": "2026-08-27T17:57:46.990Z",
    "dateReserved": "2026-07-04T18:13:26.298Z",
    "dateUpdated": "2026-08-27T17:57:46.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59287 (GCVE-0-2026-59287)

Vulnerability from nvd – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL WebSocket Client Denial of Service

Summary

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

Severity

No CVSS data available.

CWE

CWE-770 Allocation of Resources Without Limits or Throttling

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59287

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom) Affected: 1.4.0 , ≤ 1.4.6 (custom) Affected: 1.3.0 , ≤ 1.3.9 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.3.9",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003cbr/\u003eSpring for GraphQL 1.4.0 - 1.4.6\u003cbr/\u003eSpring for GraphQL 1.3.0 - 1.3.9\u003c/p\u003e"
            }
          ],
          "value": "Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.3.0 - 1.3.9"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:45.951Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59287"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL WebSocket Client Denial of Service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59287",
    "datePublished": "2026-08-27T17:57:45.951Z",
    "dateReserved": "2026-07-04T18:13:26.297Z",
    "dateUpdated": "2026-08-27T17:57:45.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59286 (GCVE-0-2026-59286)

Vulnerability from nvd – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL loads Untrusted Resources in GraphiQL support

Summary

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

Severity

No CVSS data available.

CWE

CWE-494 Download of Code Without Integrity Check

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59286

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom) Affected: 1.4.0 , ≤ 1.4.6 (custom) Affected: 1.1.0 , ≤ 1.3.9 (custom) Affected: 1.0.0 , ≤ 1.0.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.3.9",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003cbr/\u003eSpring for GraphQL 1.4.0 - 1.4.6\u003cbr/\u003eSpring for GraphQL 1.1.0 - 1.3.9\u003cbr/\u003eSpring for GraphQL 1.0.0 - 1.0.7\u003c/p\u003e"
            }
          ],
          "value": "The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.1.0 - 1.3.9\nSpring for GraphQL 1.0.0 - 1.0.7"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-494 Download of Code Without Integrity Check",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:44.958Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59286"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL loads Untrusted Resources in GraphiQL support"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59286",
    "datePublished": "2026-08-27T17:57:44.958Z",
    "dateReserved": "2026-07-04T18:13:26.297Z",
    "dateUpdated": "2026-08-27T17:57:44.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59285 (GCVE-0-2026-59285)

Vulnerability from nvd – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL Unsafe Deserialization in pagination support

Summary

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

Severity

No CVSS data available.

CWE

CWE-502 Deserialization of Untrusted Data

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59285

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003c/p\u003e"
            }
          ],
          "value": "Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.\nSpring for GraphQL 2.0.0 - 2.0.4"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:43.851Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59285"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL Unsafe Deserialization in pagination support"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59285",
    "datePublished": "2026-08-27T17:57:43.851Z",
    "dateReserved": "2026-07-04T18:13:26.297Z",
    "dateUpdated": "2026-08-27T17:57:43.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41856 (GCVE-0-2026-41856)

Vulnerability from nvd – Published: 2026-06-11 05:05 – Updated: 2026-06-30 21:52

Title

Spring GraphQL Annotation Detection Vulnerability

Summary

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-11 15:16 UTC

CWE

CWE-284 - Improper Access Control

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-41856

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , < 2.0.3.1 (custom) Affected: 1.4.0 , < 1.4.5.1 (custom) Affected: 1.3.0 , < 1.3.9 (custom) Affected: 1.0.0 , < 1.0.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T15:16:49.624069Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T15:16:55.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "2.0.3.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.5.1",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.9",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6."
            }
          ],
          "value": "The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring Security authorization annotations can be ignored at runtime for @Controller classes within type hierarchies, allowing unauthorized access to protected GraphQL data fetchers."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T21:52:23.654Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41856"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring GraphQL Annotation Detection Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41856",
    "datePublished": "2026-06-11T05:05:00.491Z",
    "dateReserved": "2026-04-22T06:22:10.081Z",
    "dateUpdated": "2026-06-30T21:52:23.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41700 (GCVE-0-2026-41700)

Vulnerability from nvd – Published: 2026-06-11 05:04 – Updated: 2026-06-30 21:51

Title

Cross-Site WebSocket Hijacking in Spring for GraphQL

Summary

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-11 14:43 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-41700

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , < 2.0.3.1 (custom) Affected: 1.4.0 , < 1.4.5.1 (custom) Affected: 1.3.0 , < 1.3.9 (custom) Affected: 1.0.0 , < 1.0.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41700",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T14:43:29.371645Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T14:43:36.170Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "2.0.3.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.5.1",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.9",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim\u0027s credentials.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6."
            }
          ],
          "value": "Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim\u0027s credentials.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim\u0027s credentials via a cross-site WebSocket hijacking attack."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T21:51:38.214Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41700"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site WebSocket Hijacking in Spring for GraphQL",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41700",
    "datePublished": "2026-06-11T05:04:47.722Z",
    "dateReserved": "2026-04-22T06:21:22.982Z",
    "dateUpdated": "2026-06-30T21:51:38.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41699 (GCVE-0-2026-41699)

Vulnerability from nvd – Published: 2026-06-11 05:04 – Updated: 2026-06-30 21:51

Title

Unsafe Deserialization in Spring GraphQL

Summary

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-11 14:43 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-41699

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , < 2.0.3.1 (custom) Affected: 1.4.0 , < 1.4.5.1 (custom) Affected: 1.3.0 , < 1.3.9 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T14:43:00.411379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T14:43:08.813Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "2.0.3.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.5.1",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.9",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8."
            }
          ],
          "value": "Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can craft a malicious paginated GraphQL query that leads to Remote Code Execution when the application classpath contains specific gadget classes."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T21:51:09.488Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41699"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unsafe Deserialization in Spring GraphQL",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41699",
    "datePublished": "2026-06-11T05:04:43.290Z",
    "dateReserved": "2026-04-22T06:21:22.982Z",
    "dateUpdated": "2026-06-30T21:51:09.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-34047 (GCVE-0-2023-34047)

Vulnerability from nvd – Published: 2023-09-20 09:09 – Updated: 2024-09-24 19:04

Title

Exposure of data and identity to wrong session in Spring for GraphQL

Summary

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-24 19:03 UTC

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2023-34047

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 1.1.0 , < 1.1.6 (1.1.6) Affected: 1.2.0 , < 1.2.3 (1.2.3)

Date Public

2023-09-19 09:02

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:53.784Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2023-34047"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34047",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T19:03:52.170001Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T19:04:05.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "iOS",
            "Android",
            "x86",
            "ARM",
            "64 bit",
            "MacOS",
            "32 bit"
          ],
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.1.6",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "1.1.6"
            },
            {
              "lessThan": "1.2.3",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "1.2.3"
            }
          ]
        }
      ],
      "datePublic": "2023-09-19T09:02:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a \u003c/span\u003e\u003ccode\u003eDataLoaderOptions\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;instance when registering batch loader functions through \u003c/span\u003e\u003ccode\u003eDefaultBatchLoaderRegistry\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions\u00a0instance when registering batch loader functions through DefaultBatchLoaderRegistry.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-20T09:09:12.648Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2023-34047"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Exposure of data and identity to wrong session in Spring for GraphQL",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34047",
    "datePublished": "2023-09-20T09:09:12.648Z",
    "dateReserved": "2023-05-25T17:21:56.202Z",
    "dateUpdated": "2024-09-24T19:04:05.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-59289 (GCVE-0-2026-59289)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL Denial of Service via pagination support

Summary

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9

Severity

No CVSS data available.

CWE

CWE-770 Allocation of Resources Without Limits or Throttling

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59289

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom) Affected: 1.4.0 , ≤ 1.4.6 (custom) Affected: 1.2.0 , ≤ 1.3.9 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.3.9",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring for GraphQL\u0027s Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003cbr/\u003eSpring for GraphQL 1.4.0 - 1.4.6\u003cbr/\u003eSpring for GraphQL 1.2.0 - 1.3.9\u003c/p\u003e"
            }
          ],
          "value": "Spring for GraphQL\u0027s Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.2.0 - 1.3.9"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring for GraphQL\u0027s Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:47.944Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59289"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL Denial of Service via pagination support"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59289",
    "datePublished": "2026-08-27T17:57:47.944Z",
    "dateReserved": "2026-07-04T18:13:34.323Z",
    "dateUpdated": "2026-08-27T17:57:47.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59288 (GCVE-0-2026-59288)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL Information Exposure in GraphiQL support

Summary

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

Severity

No CVSS data available.

CWE

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59288

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom) Affected: 1.4.0 , ≤ 1.4.6 (custom) Affected: 1.1.0 , ≤ 1.3.9 (custom) Affected: 1.0.0 , ≤ 1.0.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.3.9",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim\u0027s browser might leak confidential information to the attacker\u0027s website.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003cbr/\u003eSpring for GraphQL 1.4.0 - 1.4.6\u003cbr/\u003eSpring for GraphQL 1.1.0 - 1.3.9\u003cbr/\u003eSpring for GraphQL 1.0.0 - 1.0.7\u003c/p\u003e"
            }
          ],
          "value": "The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim\u0027s browser might leak confidential information to the attacker\u0027s website.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.1.0 - 1.3.9\nSpring for GraphQL 1.0.0 - 1.0.7"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim\u0027s browser might leak confidential information to the attacker\u0027s website."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:46.990Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59288"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL Information Exposure in GraphiQL support"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59288",
    "datePublished": "2026-08-27T17:57:46.990Z",
    "dateReserved": "2026-07-04T18:13:26.298Z",
    "dateUpdated": "2026-08-27T17:57:46.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59287 (GCVE-0-2026-59287)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL WebSocket Client Denial of Service

Summary

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

Severity

No CVSS data available.

CWE

CWE-770 Allocation of Resources Without Limits or Throttling

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59287

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom) Affected: 1.4.0 , ≤ 1.4.6 (custom) Affected: 1.3.0 , ≤ 1.3.9 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.3.9",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003cbr/\u003eSpring for GraphQL 1.4.0 - 1.4.6\u003cbr/\u003eSpring for GraphQL 1.3.0 - 1.3.9\u003c/p\u003e"
            }
          ],
          "value": "Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.3.0 - 1.3.9"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:45.951Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59287"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL WebSocket Client Denial of Service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59287",
    "datePublished": "2026-08-27T17:57:45.951Z",
    "dateReserved": "2026-07-04T18:13:26.297Z",
    "dateUpdated": "2026-08-27T17:57:45.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59286 (GCVE-0-2026-59286)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL loads Untrusted Resources in GraphiQL support

Summary

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

Severity

No CVSS data available.

CWE

CWE-494 Download of Code Without Integrity Check

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59286

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom) Affected: 1.4.0 , ≤ 1.4.6 (custom) Affected: 1.1.0 , ≤ 1.3.9 (custom) Affected: 1.0.0 , ≤ 1.0.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.3.9",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003cbr/\u003eSpring for GraphQL 1.4.0 - 1.4.6\u003cbr/\u003eSpring for GraphQL 1.1.0 - 1.3.9\u003cbr/\u003eSpring for GraphQL 1.0.0 - 1.0.7\u003c/p\u003e"
            }
          ],
          "value": "The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.1.0 - 1.3.9\nSpring for GraphQL 1.0.0 - 1.0.7"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-494 Download of Code Without Integrity Check",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:44.958Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59286"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL loads Untrusted Resources in GraphiQL support"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59286",
    "datePublished": "2026-08-27T17:57:44.958Z",
    "dateReserved": "2026-07-04T18:13:26.297Z",
    "dateUpdated": "2026-08-27T17:57:44.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59285 (GCVE-0-2026-59285)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-27 17:57

Title

Spring for GraphQL Unsafe Deserialization in pagination support

Summary

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

Severity

No CVSS data available.

CWE

CWE-502 Deserialization of Untrusted Data

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59285

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , ≤ 2.0.4 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.\u003c/p\u003e\u003cp\u003eSpring for GraphQL 2.0.0 - 2.0.4\u003c/p\u003e"
            }
          ],
          "value": "Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.\nSpring for GraphQL 2.0.0 - 2.0.4"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:43.851Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59285"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring for GraphQL Unsafe Deserialization in pagination support"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59285",
    "datePublished": "2026-08-27T17:57:43.851Z",
    "dateReserved": "2026-07-04T18:13:26.297Z",
    "dateUpdated": "2026-08-27T17:57:43.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41856 (GCVE-0-2026-41856)

Vulnerability from cvelistv5 – Published: 2026-06-11 05:05 – Updated: 2026-06-30 21:52

Title

Spring GraphQL Annotation Detection Vulnerability

Summary

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-11 15:16 UTC

CWE

CWE-284 - Improper Access Control

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-41856

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , < 2.0.3.1 (custom) Affected: 1.4.0 , < 1.4.5.1 (custom) Affected: 1.3.0 , < 1.3.9 (custom) Affected: 1.0.0 , < 1.0.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T15:16:49.624069Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T15:16:55.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "2.0.3.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.5.1",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.9",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6."
            }
          ],
          "value": "The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring Security authorization annotations can be ignored at runtime for @Controller classes within type hierarchies, allowing unauthorized access to protected GraphQL data fetchers."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T21:52:23.654Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41856"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring GraphQL Annotation Detection Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41856",
    "datePublished": "2026-06-11T05:05:00.491Z",
    "dateReserved": "2026-04-22T06:22:10.081Z",
    "dateUpdated": "2026-06-30T21:52:23.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41700 (GCVE-0-2026-41700)

Vulnerability from cvelistv5 – Published: 2026-06-11 05:04 – Updated: 2026-06-30 21:51

Title

Cross-Site WebSocket Hijacking in Spring for GraphQL

Summary

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-11 14:43 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-41700

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , < 2.0.3.1 (custom) Affected: 1.4.0 , < 1.4.5.1 (custom) Affected: 1.3.0 , < 1.3.9 (custom) Affected: 1.0.0 , < 1.0.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41700",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T14:43:29.371645Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T14:43:36.170Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "2.0.3.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.5.1",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.9",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim\u0027s credentials.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6."
            }
          ],
          "value": "Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim\u0027s credentials.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim\u0027s credentials via a cross-site WebSocket hijacking attack."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T21:51:38.214Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41700"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site WebSocket Hijacking in Spring for GraphQL",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41700",
    "datePublished": "2026-06-11T05:04:47.722Z",
    "dateReserved": "2026-04-22T06:21:22.982Z",
    "dateUpdated": "2026-06-30T21:51:38.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41699 (GCVE-0-2026-41699)

Vulnerability from cvelistv5 – Published: 2026-06-11 05:04 – Updated: 2026-06-30 21:51

Title

Unsafe Deserialization in Spring GraphQL

Summary

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-11 14:43 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-41699

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 2.0.0 , < 2.0.3.1 (custom) Affected: 1.4.0 , < 1.4.5.1 (custom) Affected: 1.3.0 , < 1.3.9 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T14:43:00.411379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T14:43:08.813Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "2.0.3.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.5.1",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.9",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8."
            }
          ],
          "value": "Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can craft a malicious paginated GraphQL query that leads to Remote Code Execution when the application classpath contains specific gadget classes."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T21:51:09.488Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41699"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unsafe Deserialization in Spring GraphQL",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41699",
    "datePublished": "2026-06-11T05:04:43.290Z",
    "dateReserved": "2026-04-22T06:21:22.982Z",
    "dateUpdated": "2026-06-30T21:51:09.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-34047 (GCVE-0-2023-34047)

Vulnerability from cvelistv5 – Published: 2023-09-20 09:09 – Updated: 2024-09-24 19:04

Title

Exposure of data and identity to wrong session in Spring for GraphQL

Summary

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-24 19:03 UTC

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2023-34047

Impacted products

1 product

Vendor	Product	Version
Spring	Spring for GraphQL	Affected: 1.1.0 , < 1.1.6 (1.1.6) Affected: 1.2.0 , < 1.2.3 (1.2.3)

Date Public

2023-09-19 09:02

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:53.784Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2023-34047"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34047",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T19:03:52.170001Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T19:04:05.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "iOS",
            "Android",
            "x86",
            "ARM",
            "64 bit",
            "MacOS",
            "32 bit"
          ],
          "product": "Spring for GraphQL",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.1.6",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "1.1.6"
            },
            {
              "lessThan": "1.2.3",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "1.2.3"
            }
          ]
        }
      ],
      "datePublic": "2023-09-19T09:02:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a \u003c/span\u003e\u003ccode\u003eDataLoaderOptions\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;instance when registering batch loader functions through \u003c/span\u003e\u003ccode\u003eDefaultBatchLoaderRegistry\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions\u00a0instance when registering batch loader functions through DefaultBatchLoaderRegistry.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-20T09:09:12.648Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2023-34047"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Exposure of data and identity to wrong session in Spring for GraphQL",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34047",
    "datePublished": "2023-09-20T09:09:12.648Z",
    "dateReserved": "2023-05-25T17:21:56.202Z",
    "dateUpdated": "2024-09-24T19:04:05.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

18 vulnerabilities found for Spring for GraphQL by Spring

CVE-2026-59289 (GCVE-0-2026-59289)

CVE-2026-59288 (GCVE-0-2026-59288)

CVE-2026-59287 (GCVE-0-2026-59287)

CVE-2026-59286 (GCVE-0-2026-59286)

CVE-2026-59285 (GCVE-0-2026-59285)

CVE-2026-41856 (GCVE-0-2026-41856)

CVE-2026-41700 (GCVE-0-2026-41700)

CVE-2026-41699 (GCVE-0-2026-41699)

CVE-2023-34047 (GCVE-0-2023-34047)

CVE-2026-59289 (GCVE-0-2026-59289)

CVE-2026-59288 (GCVE-0-2026-59288)

CVE-2026-59287 (GCVE-0-2026-59287)

CVE-2026-59286 (GCVE-0-2026-59286)

CVE-2026-59285 (GCVE-0-2026-59285)

CVE-2026-41856 (GCVE-0-2026-41856)

CVE-2026-41700 (GCVE-0-2026-41700)

CVE-2026-41699 (GCVE-0-2026-41699)

CVE-2023-34047 (GCVE-0-2023-34047)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

18 vulnerabilities found for Spring for GraphQL by Spring

CVE-2026-59289 (GCVE-0-2026-59289)

CVE-2026-59288 (GCVE-0-2026-59288)

CVE-2026-59287 (GCVE-0-2026-59287)

CVE-2026-59286 (GCVE-0-2026-59286)

CVE-2026-59285 (GCVE-0-2026-59285)

CVE-2026-41856 (GCVE-0-2026-41856)

CVE-2026-41700 (GCVE-0-2026-41700)

CVE-2026-41699 (GCVE-0-2026-41699)

CVE-2023-34047 (GCVE-0-2023-34047)

CVE-2026-59289 (GCVE-0-2026-59289)

CVE-2026-59288 (GCVE-0-2026-59288)

CVE-2026-59287 (GCVE-0-2026-59287)

CVE-2026-59286 (GCVE-0-2026-59286)

CVE-2026-59285 (GCVE-0-2026-59285)

CVE-2026-41856 (GCVE-0-2026-41856)

CVE-2026-41700 (GCVE-0-2026-41700)

CVE-2026-41699 (GCVE-0-2026-41699)

CVE-2023-34047 (GCVE-0-2023-34047)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.