CVE-2026-41699highCWE-502

CVE-2026-41699: falha de alta gravidade em Spring for GraphQL

Unsafe Deserialization in Spring GraphQL

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring for GraphQL+ Monitorar org.springframework.graphql:spring-graphql

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.4%
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Spring · Spring for GraphQL
CVEs relacionadas — Spring for GraphQL

No mesmo produto, das mais perigosas para as menos.

CVE-2026-59289HIGHSpring for GraphQL Denial of Service via pagination supportEPSS 0.5%CVE-2026-59285HIGHSpring for GraphQL Unsafe Deserialization in pagination supportEPSS 0.4%CVE-2023-34047LOWExposure of data and identity to wrong session in Spring for GraphQLEPSS 0.4%CVE-2026-59288HIGHSpring for GraphQL Information Exposure in GraphiQL supportEPSS 0.4%CVE-2026-59287MEDIUMSpring for GraphQL WebSocket Client Denial of ServiceEPSS 0.4%CVE-2026-41856HIGHSpring GraphQL Annotation Detection VulnerabilityEPSS 0.4%