EUVD-2026-67178
GHSA-ffhp-m2c7-jv8h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-accessible GraphQL endpoint with no authentication required; impact is exclusively availability via resource exhaustion, with no confidentiality or integrity consequences.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9
AnalysisAI
Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The application must use Spring for GraphQL's Spring Data pagination integration and expose at least one Connection-type GraphQL field backed by a scrollable Spring Data repository query - this is not a separately toggled feature flag but an inherent behavior of the pagination support in affected versions (2.0.0-2.0.4, 1.4.0-1.4.6, 1.2.0-1.3.9). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (High) reflects a worst-case network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N, UI:N) attack with high availability impact (A:H) and no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Spring for GraphQL to a version beyond the affected ranges per the vendor advisory at https://spring.io/security/cve-2026-59289; exact patched version numbers (e.g., 2.0.5+, 1.4.7+) must be confirmed from that advisory as no specific fix versions were included in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Spring for GraphQL instances and confirm versions 1.2.0-1.3.9, 1.4.0-1.4.6, and 2.0.0-2.0.4 in production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today