7.5
Élevée
CVE-2026-59288 The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application
Description
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring for GraphQL 2.0 | 2.0.0 → 2.0.4 | Pas de correctif indiqué |
| Spring for GraphQL 1.4 | 1.4.0 → 1.4.6 | Pas de correctif indiqué |
| Spring for GraphQL 1.1 | 1.1.0 → 1.3.9 | Pas de correctif indiqué |
| Spring for GraphQL 1.0 | 1.0.0 → 1.0.7 | Pas de correctif indiqué |
Autres CVE de Spring for GraphQL
Les 9 CVE de Spring for GraphQL →
CVE-2026-59289
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the…
7.5
Élevée
CVE-2026-59287
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled
5.9
Moyenne
CVE-2026-59286
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource…
8.1
Élevée
CVE-2026-59285
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries
8.1
Élevée