Description
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
Spring for GraphQL 2.0.0 - 2.0.4
Published: 2026-08-27
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

Spring for GraphQL performs deserialization of pagination information without proper validation, allowing an attacker to supply crafted data that can instantiate unintended classes. The flaw is classified as CWE-502 and can enable the execution of arbitrary code, exposing the application to complete compromise of confidentiality, integrity, and availability.

Affected Systems

The vulnerability impacts Spring for GraphQL versions 2.0.0 through 2.0.4. Deployments running any of these releases are at risk; no other versions are listed as affected in the advisory.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, meaning no widespread exploitation is known yet. The most likely attack vector is remote, exploiting the GraphQL API’s pagination parameters, which require an attacker to inject malicious payloads into a paginated query.

Generated by OpenCVE AI on August 31, 2026 at 23:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply any vendor‑supplied security patch that fixes the unsafe deserialization issue.
  • If a patch is not yet available, limit or reject pagination data that is deserialized, ensuring only trusted input reaches the deserialization process.
  • Implement strict input validation or type‑checking for pagination parameters to prevent arbitrary object creation during deserialization, following best practices for safe deserialization.

Generated by OpenCVE AI on August 31, 2026 at 23:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://spring.io/security/cve-2026-59285 cve-icon cve-icon
History

Wed, 02 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Vmware
Vmware spring For Graphql
CPEs cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*
Vendors & Products Vmware
Vmware spring For Graphql
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 28 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-502

Fri, 28 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Spring
Spring spring For Graphql
Vendors & Products Spring
Spring spring For Graphql

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4
Title Spring for GraphQL Unsafe Deserialization in pagination support
References

Subscriptions

Spring Spring For Graphql
Vmware Spring For Graphql
cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-09-02T18:14:59.496Z

Reserved: 2026-07-04T18:13:26.297Z

Link: CVE-2026-59285

cve-icon Vulnrichment

Updated: 2026-09-02T18:14:38.206Z

cve-icon NVD

Status : Modified

Published: 2026-08-27T20:17:54.693

Modified: 2026-09-02T19:17:25.417

Link: CVE-2026-59285

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T23:45:06Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data