Vulnerability · Published Aug 27, 2026 · Assigned by vmware
CVE-2026-59289Spring for GraphQL Denial of Service via pagination support
High 7.5
In plain English
A high-severity resource allocation without limits in Spring for GraphQL from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring for GraphQL | 2.0.0 – through 2.0.41.4.0 – through 1.4.61.2.0 – through 1.3.9 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H