EUVD-2026-36212
GHSA-px92-q6rc-6mwv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but exploitation requires a Connection field exposure plus suitable gadget classes on the classpath, which justifies AC:H; full RCE yields C/I/A:H.
Primary rating from Vendor (vmware).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
Articles & Coverage 2
AnalysisAI
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated attackers to trigger unsafe deserialization by sending crafted paginated GraphQL queries against Connection-type fields. Exploitation requires that the application expose a paginated (Connection) field and that the classpath contains gadget classes leveraged during deserialization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The application must expose at least one paginated GraphQL field of Relay Connection type through Spring for GraphQL on a vulnerable version (1.3.0-1.3.8, 1.4.0-1.4.5, or 2.0.0-2.0.3), and the JVM classpath must contain deserialization gadget classes that can be chained to reach code execution (otherwise the unsafe deserialization yields an error rather than RCE). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H produces a critical 9.8, reflecting unauthenticated network-reachable RCE potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a publicly reachable Spring Boot service exposing a GraphQL endpoint with a Connection-typed field (for example, a `users(first: 10, after: ...)` query). They send a crafted GraphQL request whose pagination cursor encodes a malicious serialized object graph; when Spring for GraphQL deserializes it, a gadget chain present on the application classpath executes attacker-controlled code in the JVM process. … |
| Remediation | Vendor-released patch: upgrade Spring for GraphQL to 1.3.9, 1.4.6, or 2.0.4 depending on your maintenance branch, as published in the Spring advisory at https://spring.io/security/cve-2026-41699 and corroborated by https://nvd.nist.gov/vuln/detail/CVE-2026-41699 and https://vuldb.com/vuln/370356. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all applications using Spring for GraphQL and determine which expose paginated Connection fields. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.tran
NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers t
Origin validation failure in Spring Cloud Gateway (WebMVC and WebFlux Server variants) allows remote attackers to spoof
Server-Side Request Forgery in Spring Web Services (versions 3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, and 5.0.0-5.0.1) al
XML External Entity (XXE) exposure in Spring Web Services' Jaxp13XPathTemplate allows remote attackers to abuse XPath ev
Share
External POC / Exploit Code
Leaving vuln.today