Spring for GraphQL is vulnerable when its WebSocket client keeps the keepAlive flag enabled. The flaw allows an attacker to flood the server with keepAlive frames, exhausting socket and memory resources and causing a denial of service. Because the vulnerability arises from unchecked client input over a network channel, it can be triggered remotely without authentication, potentially taking the entire service offline.

This issue affects the Spring for GraphQL component of the Spring framework. Vulnerable versions include 2.0.0 through 2.0.4, 1.4.0 through 1.4.6, and 1.3.0 through 1.3.9. All installations using these versions with an enabled keepAlive setting are at risk.

The CVSS score of 5.9 reflects a moderate impact, while the EPSS score of < 1% indicates a low probability of exploitation in the wild. The attack vector is inferred to be remote over the WebSocket protocol, as the vulnerability is tied to client‑side keepAlive frames. The flaw remains unlisted in the CISA Known Exploited Vulnerabilities catalog, but the lack of a preventive patch in the affected releases means that risk is primarily driven by the potential for a remote denial of service that could disrupt business operations.