Spring for GraphQL’s pagination handling can be manipulated by an attacker who crafts a malicious Connection field query. The framework forwards the client‑supplied pagination values directly to the underlying repository, allowing an attacker to exhaust application memory or impose a prolonged, heavy load on the datastore. The result is a Denial of Service that leads to loss of availability for legitimate users.

The vulnerability affects Spring for GraphQL versions 2.0.0 through 2.0.4, 1.4.0 through 1.4.6, and 1.2.0 through 1.3.9. These are distributed by the Spring project and used in Spring‑based GraphQL applications.

No public exploit has been reported and the EPSS score is unavailable, so the exact likelihood of attack is uncertain. The weakness is a classic resource‑exhaustion flaw (CWE‑399/CWE‑400) that can be triggered via the exposed GraphQL endpoint; an attacker only needs the ability to send crafted queries to the service. The lack of KEV listing suggests the vulnerability is not actively exploited at this time, but because denial of service can have business‑critical impact, the risk remains moderate to high.