Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.

More precisely, an application is vulnerable when all the following are true:

• the application is using the WebSocketGraphQlClient to query a GraphQL API
• the keepAlive option is configured on the client
• the attacker can interfere with the WebSocket connection

When all the conditions above are met, an attacker may exhaust application memory, resulting in a Denial of Service. For this, the attacker needs to control the GraphQL server or perform a Man-in-the-Middle attack on the WebSocket connection.