CVE-2026-59287

Modified Modified - Updated After Analysis

Denial of Service in Spring for GraphQL via WebSocket KeepAlive

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59287

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_for_graphql	From 1.4.0 (inc) to 1.4.7 (exc)
vmware	spring_for_graphql	From 2.0.0 (inc) to 2.0.4.1 (exc)
vmware	spring_for_graphql	From 1.3.0 (inc) to 1.3.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. This occurs if an application uses WebSocketGraphQlClient to query a GraphQL API, has keepAlive configured, and an attacker can interfere with the WebSocket connection. The attacker could exhaust the application's memory, causing a DoS.

Detection Guidance

Detecting this vulnerability requires checking if your system uses Spring for GraphQL with WebSocketGraphQlClient and keepAlive enabled. Inspect application logs for WebSocket connections and memory usage patterns. Monitor for unusual memory consumption or crashes in applications using affected versions.

Impact Analysis

This vulnerability could allow an attacker to crash your application by consuming all available memory. This would make your service unavailable to legitimate users, leading to downtime and potential data loss.

Compliance Impact

This vulnerability could lead to a Denial of Service (DoS) condition, which may cause service disruptions or unavailability. Such disruptions could impact compliance with regulations like GDPR (data processing availability) or HIPAA (system availability for protected health information).

Mitigation Strategies

Upgrade to fixed versions immediately: Spring for GraphQL 2.0.5 (OSS), 2.0.4.1 (Enterprise), 1.4.7 (Enterprise), or 1.3.10 (Enterprise). No other mitigation is required beyond upgrading. Disable keepAlive on WebSocketGraphQlClient if upgrading is not possible.

Hi! I’m here to help you understand CVE-2026-59287. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70