PatchTheCVEspring for graphql vulnerabilities and fixes
Recent CVEs affecting spring for graphql, with upgrade or downgrade steps. 5 tracked.
Also searched as: springforgraphql.
spring for graphql has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-27. Highest priority: CVE-2026-59285 (score 43/100).
- CVE-2026-59285 HIGH 8.1 UPGRADE Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL que
- CVE-2026-59286 HIGH 8.1 UPGRADE The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subres
- CVE-2026-59289 HIGH 7.5 UPGRADE Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the
- CVE-2026-59287 MEDIUM 5.9 UPGRADE Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive e
- CVE-2026-59288 HIGH 7.4 UPGRADE The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application
FAQ
How do I fix spring for graphql vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spring for graphql being exploited right now?
None of the tracked spring for graphql CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spring for graphql CVE should I patch first?
CVE-2026-59285 currently ranks highest (43/100): Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL que.