Unsafe Deserialization in Spring GraphQL
CVE-2026-41699

8.1HIGH

Key Information:

Vendor

Spring

Status
Spring For Graphql
Vendor
CVE Published:
11 June 2026

What is CVE-2026-41699?

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.

Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.

Affected Version(s)

Spring for GraphQL 2.0.0 < 2.0.4

Spring for GraphQL 1.4.0 < 1.4.6

Spring for GraphQL 1.3.0 < 1.3.9

References

https://spring.io/security/cve-2026-41699

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.