high8.1
CVE-2026-41699
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
Impact
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.graphql:spring-graphql | >= 2.0.0, <= 2.0.3 | 2.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring For Graphql | from 1.3.0 before 1.3.9 from 1.4.0 before 1.4.5.1 from 2.0.0 before 2.0.3.1 |