Unsafe Deserialization in Spring for GraphQL Applications
CVE-2026-41699

8.1HIGH

Key Information:

Vendor

Spring

Status
Spring For Graphql
Vendor
CVE Published:
11 June 2026

What is CVE-2026-41699?

Spring for GraphQL applications are vulnerable to unsafe deserialization when handling paginated GraphQL queries. Attackers can exploit this vulnerability by crafting malicious GraphQL requests, potentially leading to remote code execution if the application exposes paginated (Connection) fields and contains specific classes on the classpath that can be manipulated during deserialization. Inadequate validation of serialized data from untrusted sources allows attackers to compromise the integrity and security of the application.

Affected Version(s)

Spring for GraphQL 2.0.0 < 2.0.3.1

Spring for GraphQL 1.4.0 < 1.4.5.1

Spring for GraphQL 1.3.0 < 1.3.9

References

https://spring.io/security/cve-2026-41699

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.