CVE-2026-59285
published 2026-08-27CVE-2026-59285: Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4
PriorityP345high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.44%
36.9th percentile
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
Spring for GraphQL 2.0.0 - 2.0.4
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_for_graphql | 2.0.0 – 2.0.4 | — |
| vmware | spring_for_graphql | >= 2.0.0 < 2.0.4.1 | 2.0.4.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
ghsa_unreviewed·2026-08-27
CVE-2026-59285 Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
Spring for GraphQL 2.0.0 - 2.0.4
VulDB
VMware Spring for GraphQL up to 2.0.4 deserialization
vuldb·2026-08-27
CVE-2026-59285 [CRITICAL] VMware Spring for GraphQL up to 2.0.4 deserialization
A vulnerability was found in VMware Spring for GraphQL up to 2.0.4 and classified as critical. This impacts an unknown function. The manipulation results in deserialization.
This vulnerability is reported as CVE-2026-59285. The attack can be launched remotely. No exploit exists.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-27
Published