CVE-2026-41699

published 2026-06-11

CVE-2026-41699: Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL…

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.

Affected versions:
Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
spring	spring_for_graphql	>= 1.3.0 < 1.3.9	1.3.9
spring	spring_for_graphql	>= 1.4.0 < 1.4.5.1	1.4.5.1
spring	spring_for_graphql	>= 2.0.0 < 2.0.3.1	2.0.3.1
vmware	spring_for_graphql	>= 1.3.0 < 1.3.9	1.3.9
vmware	spring_for_graphql	>= 1.4.0 < 1.4.6	1.4.6
vmware	spring_for_graphql	>= 2.0.0 < 2.0.4	2.0.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502