Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-59289: Spring for GraphQL can be overloaded via pagination

CVE-2026-59289 · published 2 months ago

Summary

Versions of Spring for GraphQL (1.2.0‑1.3.9, 1.4.0‑1.4.6, and 2.0.0‑2.0.4) can be tricked into using very large pagination values. This can fill up memory or create heavy load on the database, potentially causing the service to stop responding. Update to the latest released version of Spring for GraphQL to protect against this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
vmware	spring_for_graphql	>= 1.2.0, < 1.3.10 >= 1.4.0, < 1.4.7 >= 2.0.0, < 2.0.4.1 `cpe:2.3:a:vmware:spring_for_graphql::::::::`
spring	spring for graphql	<= 2.0.4

Original advisory text

Spring for GraphQL Denial of Service via pagination support

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service.
Spring for GraphQL 2.0.0 - 2.0.4
Spring for GraphQL 1.4.0 - 1.4.6
Spring for GraphQL 1.2.0 - 1.3.9

References

https://spring.io/security/cve-2026-59289 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published27 Aug 2026

Updated4 Nov 2026

First seen27 Aug 2026

Sources

CVE-2026-59289 · NVD

CVE-2026-59289 · MITRE

Track software like this

Free during beta