Spring For Graphql
Monthly
Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.
Cross-origin data exfiltration in Spring for GraphQL exposes confidential application data when a victim browses a crafted URL pointing to the bundled GraphiQL interface. The GraphiQL IDE, intended for development use, can be weaponized to direct the victim's authenticated browser session to send GraphQL queries whose responses are leaked to an attacker-controlled origin. All major release lines from 1.0.0 through 2.0.4 are affected; no public exploit has been identified and the EPSS score sits at the 4th percentile, but the high confidentiality impact (C:H) and scope change make this notable for any deployment with GraphiQL exposed beyond trusted networks.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
Unsafe deserialization in Spring for GraphQL 2.0.0-2.0.4 exposes Java applications to potential remote code execution when processing paginated GraphQL queries. The flaw, classified as CWE-502, allows network-accessible, unauthenticated attackers to supply crafted payloads through pagination parameters that are deserialized server-side without adequate type safety. CVSS 8.1 with AC:H reflects that exploitation hinges on the presence of a suitable Java gadget chain on the application classpath; EPSS of 0.44% (36th percentile) and no KEV listing indicate no widespread exploitation has been observed at time of analysis.
Authorization bypass in Spring for GraphQL (versions 1.0.0-1.0.6, 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3) allows remote attackers to invoke @Controller data fetcher methods whose security annotations are declared on parent classes or interfaces, because the framework's annotation detection does not consistently resolve annotations across type hierarchies. The flaw is rated CVSS 7.5 (confidentiality-only impact) and no public exploit identified at time of analysis, but the network-reachable, no-privilege CVSS vector makes any affected GraphQL endpoint a meaningful exposure.
Cross-Site WebSocket Hijacking in Spring for GraphQL allows remote attackers to execute arbitrary GraphQL operations under an authenticated victim's identity when the application has enabled the GraphQL WebSocket transport. The flaw stems from missing origin validation on WebSocket handshakes (CWE-346), affecting Spring for GraphQL 1.0.x, 1.3.x, 1.4.x, and 2.0.x branches up to 2.0.3. No public exploit identified at time of analysis, but the high CVSS (8.1) and reliance only on a single victim click make this a meaningful risk for any deployment exposing the WebSocket endpoint.
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated attackers to trigger unsafe deserialization by sending crafted paginated GraphQL queries against Connection-type fields. Exploitation requires that the application expose a paginated (Connection) field and that the classpath contains gadget classes leveraged during deserialization. No public exploit identified at time of analysis; EPSS sits at 0.34% (57th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Resource exhaustion in Spring for GraphQL's WebSocket client allows unauthenticated remote attackers to trigger a Denial of Service when the keepAlive feature is enabled. Three release trains are affected: 1.3.x through 1.3.9, 1.4.x through 1.4.6, and 2.0.x through 2.0.4, as confirmed by the VMware/Spring vendor advisory. No public exploit code has been identified and EPSS at 0.15% (4th percentile) indicates low near-term exploitation probability, though the lack of authentication requirement warrants patching for any deployment exposing WebSocket endpoints to untrusted networks.
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.
Cross-origin data exfiltration in Spring for GraphQL exposes confidential application data when a victim browses a crafted URL pointing to the bundled GraphiQL interface. The GraphiQL IDE, intended for development use, can be weaponized to direct the victim's authenticated browser session to send GraphQL queries whose responses are leaked to an attacker-controlled origin. All major release lines from 1.0.0 through 2.0.4 are affected; no public exploit has been identified and the EPSS score sits at the 4th percentile, but the high confidentiality impact (C:H) and scope change make this notable for any deployment with GraphiQL exposed beyond trusted networks.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
Unsafe deserialization in Spring for GraphQL 2.0.0-2.0.4 exposes Java applications to potential remote code execution when processing paginated GraphQL queries. The flaw, classified as CWE-502, allows network-accessible, unauthenticated attackers to supply crafted payloads through pagination parameters that are deserialized server-side without adequate type safety. CVSS 8.1 with AC:H reflects that exploitation hinges on the presence of a suitable Java gadget chain on the application classpath; EPSS of 0.44% (36th percentile) and no KEV listing indicate no widespread exploitation has been observed at time of analysis.
Authorization bypass in Spring for GraphQL (versions 1.0.0-1.0.6, 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3) allows remote attackers to invoke @Controller data fetcher methods whose security annotations are declared on parent classes or interfaces, because the framework's annotation detection does not consistently resolve annotations across type hierarchies. The flaw is rated CVSS 7.5 (confidentiality-only impact) and no public exploit identified at time of analysis, but the network-reachable, no-privilege CVSS vector makes any affected GraphQL endpoint a meaningful exposure.
Cross-Site WebSocket Hijacking in Spring for GraphQL allows remote attackers to execute arbitrary GraphQL operations under an authenticated victim's identity when the application has enabled the GraphQL WebSocket transport. The flaw stems from missing origin validation on WebSocket handshakes (CWE-346), affecting Spring for GraphQL 1.0.x, 1.3.x, 1.4.x, and 2.0.x branches up to 2.0.3. No public exploit identified at time of analysis, but the high CVSS (8.1) and reliance only on a single victim click make this a meaningful risk for any deployment exposing the WebSocket endpoint.
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated attackers to trigger unsafe deserialization by sending crafted paginated GraphQL queries against Connection-type fields. Exploitation requires that the application expose a paginated (Connection) field and that the classpath contains gadget classes leveraged during deserialization. No public exploit identified at time of analysis; EPSS sits at 0.34% (57th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Resource exhaustion in Spring for GraphQL's WebSocket client allows unauthenticated remote attackers to trigger a Denial of Service when the keepAlive feature is enabled. Three release trains are affected: 1.3.x through 1.3.9, 1.4.x through 1.4.6, and 2.0.x through 2.0.4, as confirmed by the VMware/Spring vendor advisory. No public exploit code has been identified and EPSS at 0.15% (4th percentile) indicates low near-term exploitation probability, though the lack of authentication requirement warrants patching for any deployment exposing WebSocket endpoints to untrusted networks.
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.