Spring Spring for GraphQL
9 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-59289 | 2.0.0 – 2.0.4 ; 1.4.0 – 1.4.6 ; 1.2.0 – 1.3.9 | Spring for GraphQL Denial of Service via pagination support | HIGH 7.5 | 0.5 % | ||
| CVE-2026-59288 | 2.0.0 – 2.0.4 ; 1.4.0 – 1.4.6 ; 1.1.0 – 1.3.9 ; … | Spring for GraphQL Information Exposure in GraphiQL support | HIGH 7.5 | 0.4 % | ||
| CVE-2026-59287 | 2.0.0 – 2.0.4 ; 1.4.0 – 1.4.6 ; 1.3.0 – 1.3.9 | Spring for GraphQL WebSocket Client Denial of Service | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-59286 | 2.0.0 – 2.0.4 ; 1.4.0 – 1.4.6 ; 1.1.0 – 1.3.9 ; … | Spring for GraphQL loads Untrusted Resources in GraphiQL support | HIGH 8.1 | 0.3 % | ||
| CVE-2026-59285 | 2.0.0 – 2.0.4 | Spring for GraphQL Unsafe Deserialization in pagination support | HIGH 8.1 | 0.4 % | ||
| CVE-2026-41856 | 2.0.0 – < 2.0.3.1 ; 1.4.0 – < 1.4.5.1 ; 1.3.0 – < 1.3.9 ; … | Spring GraphQL Annotation Detection Vulnerability | HIGH 7.5 | 0.4 % | ||
| CVE-2026-41700 | 2.0.0 – < 2.0.3.1 ; 1.4.0 – < 1.4.5.1 ; 1.3.0 – < 1.3.9 ; … | Cross-Site WebSocket Hijacking in Spring for GraphQL | HIGH 8.1 | 0.2 % | ||
| CVE-2026-41699 | 2.0.0 – < 2.0.3.1 ; 1.4.0 – < 1.4.5.1 ; 1.3.0 – < 1.3.9 | Unsafe Deserialization in Spring GraphQL | CRITICAL 9.8 | 0.4 % | ||
| CVE-2023-34047 | 1.1.0 – < 1.1.6 ; 1.2.0 – < 1.2.3 | Exposure of data and identity to wrong session in Spring for GraphQL | MEDIUM 4.3 | 0.4 % |