Aller au contenu
en Se connecter
8.1 Élevée

CVE-2026-41699 Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries

Description

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring for GraphQL 2.0 2.0.0 → < 2.0.3.1 2.0.3.1
Spring for GraphQL 1.4 1.4.0 → < 1.4.5.1 1.4.5.1
Spring for GraphQL 1.3 1.3.0 → < 1.3.9 1.3.9

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Spring for GraphQL

Les 9 CVE de Spring for GraphQL →
CVE-2026-59289 Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the… 7.5 Élevée CVE-2026-59288 The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application 7.5 Élevée CVE-2026-59287 Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled 5.9 Moyenne CVE-2026-59286 The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource… 8.1 Élevée
Suivre cette CVE