SB2026083164 - Multiple vulnerabilities in Spring for GraphQL
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Download of code without integrity check (CVE-ID: CVE-2026-59286)
CWE-ID: CWE-494 - Download of Code Without Integrity Check
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code in the browser and disclose sensitive information.
The vulnerability exists due to download of code without integrity check in the bundled GraphiQL page when loading JavaScript libraries from a public CDN. A remote attacker can inject malicious code into those scripts to execute arbitrary code in the browser and disclose sensitive information.
Exploitation requires the GraphiQL endpoint to be enabled and exposed, and the CDN or the network path to it to be compromised.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-59285)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to unsafe deserialization in pagination support when processing paginated GraphQL queries. A remote attacker can send a crafted GraphQL request to execute arbitrary code.
Exploitation requires the application to use Jackson 2.x for JSON deserialization, expose a paginated connection field, and have specific classes on the classpath that can be leveraged during instantiation or deserialization.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59287)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the WebSocketGraphQlClient when using the WebSocket client with keepAlive enabled. A remote attacker can interfere with the WebSocket connection to cause a denial of service.
Exploitation requires the application to use the WebSocketGraphQlClient to query a GraphQL API with the keepAlive option configured. The attacker must control the GraphQL server or perform a man-in-the-middle attack on the WebSocket connection.
4) Information disclosure (CVE-ID: CVE-2026-59288)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the GraphiQL page bundled with Spring for GraphQL when a victim with an active session follows a malicious link to the application's GraphiQL page. A remote attacker can share a malicious url to disclose sensitive information.
The application is vulnerable only when the GraphiQL endpoint is enabled and exposed, and user interaction is required.
5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59289)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Spring Data pagination support when processing a forged GraphQL query for a Connection field. A remote attacker can send a malicious query to cause a denial of service.
The issue affects applications that expose a Connection-typed Query field backed by a Spring Data repository through auto-registration support and do not enforce additional query complexity checks.
Remediation
Install update from vendor's website.