Vmware Spring For Graphql vulnerabilities

CVE-2026-41699 [CRITICAL] CWE-502 CVE-2026-41699: Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated G Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserializa

CVE-2026-59286 [HIGH] CWE-494 CVE-2026-59286: The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, with The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.

CVE-2026-41856 [HIGH] CWE-284 CVE-2026-41856: The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly re The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.

CVE-2026-59285 [HIGH] CWE-502 CVE-2026-59285: Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated G Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

CVE-2026-41700 [HIGH] CWE-346 CVE-2026-41700: Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Si Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3;

CVE-2026-59289 [HIGH] CWE-770 CVE-2026-59289: Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and for Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of

CVE-2026-59288 [HIGH] CWE-200 CVE-2026-59288: The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the app The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for Gra

CVE-2026-59287 [MEDIUM] CWE-770 CVE-2026-59287: Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with k Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

CVE-2023-34047 [MEDIUM] CVE-2023-34047: A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be expose A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.