Spring for GraphQL’s pagination handling can be manipulated by an attacker who crafts a malicious Connection field query. The framework forwards client‑supplied pagination values directly to the underlying repository, allowing an attacker to exhaust application memory or impose a prolonged, heavy load on the datastore. The result is a Denial of Service that leads to loss of availability for legitimate users.

The vulnerability affects Spring for GraphQL versions 2.0.0 through 2.0.4, 1.4.0 through 1.4.6, and 1.2.0 through 1.3.9. These are distributed by the Spring project and used in Spring‑based GraphQL applications.

No public exploit has been reported and the EPSS score indicates a less than 1% likelihood of exploitation. The weakness is a classic resource‑exhaustion flaw (CWE‑770) that can be triggered via the exposed GraphQL endpoint; an attacker only needs the ability to send crafted queries to the service. The CVSS score of 7.5 signifies high severity, and while the lack of KEV listing suggests it is not actively exploited, denial of service can still have significant business impact, keeping the overall risk moderate to high.