Spring for GraphQL is vulnerable to unsafe deserialization when processing paginated GraphQL queries. The flaw allows an attacker to craft a malicious GraphQL request that triggers deserialization of arbitrary classes present on the application’s classpath, leading to remote code execution. This is a classic CWE‑502 deserialization weakness that compromises confidentiality, integrity, and availability of the affected system.

Affected products are Spring for GraphQL from Oracle/Spring. The vulnerability impacts the following version ranges: 2.0.0 through 2.0.3, 1.4.0 through 1.4.5, and 1.3.0 through 1.3.8. Any deployment utilizing these versions and exposing a paginated (Connection) field is susceptible.

The CVSS score of 8.1 places this issue in the high‑severity category. EPSS data is unavailable, so the current exploitation probability is unknown, but the fact that the flaw can be triggered via a standard GraphQL endpoint means it can be reachable remotely. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known active exploits, yet the high impact and inherent accessibility warrant prompt action. An attacker would need to target an exposed GraphQL API that supports pagination and include specific classes on the application classpath to leverage deserialization.