Description

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.

More precisely, an application is vulnerable when all the following are true:

• the application is using Spring GraphQL
• the application exposes a paginated (Connection) field
• the application's classpath contains specific classes that can be leveraged to execute unintended logic during instantiation or deserialization

When all the conditions above are met, an attacker can craft a malicious GraphQL request that can lead to Remote Code Execution.

Affected Spring Products and Versions

Spring for GraphQL:

• 2.0.0 - 2.0.3
• 1.4.0 - 1.4.5
• 1.3.0 - 1.3.8

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This issue was discovered internally.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1

History

• 2026-06-10: Initial vulnerability report published.