Spring for GraphQL EUVD-2026-67176

Exploitation requires that the target application explicitly uses the Spring for GraphQL WebSocket client with the keepAlive feature enabled - this specific configuration is the prerequisite that activates the vulnerable resource allocation behavior. Applications using only HTTP-based GraphQL transports (standard query-over-HTTP or multipart subscriptions) are not affected. No authentication is required (PR:N per CVSS) and no user interaction is needed (UI:N), but AC:H indicates that reliably triggering the DoS condition is non-trivial and likely requires crafted connection patterns or specific timing. External or internal network reachability to the WebSocket endpoint is required. The keepAlive configuration option being non-default or explicitly opt-in limits realistic exposure compared to the raw CVSS score might suggest.

The CVSS 5.9 Medium score accurately reflects the constrained threat model. AC:H signals that reliable exploitation is non-trivial and likely depends on specific timing, connection patterns, or state conditions beyond a simple packet send. PR:N and UI:N confirm no authentication or user interaction is required, which is a genuine concern for services with externally reachable WebSocket endpoints. The impact is strictly availability (A:H, C:N, I:N), limiting damage to service disruption with no data exfiltration or integrity risk. EPSS at 0.15% (4th percentile) strongly indicates no observed in-the-wild activity and minimal attacker interest at time of analysis. The vulnerability is absent from CISA KEV. Real-world priority is moderate: organizations with Spring for GraphQL WebSocket keepAlive exposed to untrusted networks should apply the vendor patch on their normal patching cadence; this is not an emergency-response scenario.

An attacker with network access to a service running Spring for GraphQL with WebSocket keepAlive enabled establishes one or more WebSocket connections and sends crafted or sustained traffic patterns designed to trigger unbounded resource allocation in the keepAlive handling logic. Due to AC:H, reliable triggering likely requires specific connection timing or message sequencing rather than a simple single-packet attack. Sustained exploitation results in resource exhaustion on the server, rendering the GraphQL WebSocket service unavailable to legitimate clients.