CVE-2026-59287

Received Received - Intake

Denial of Service in Spring for GraphQL via WebSocket KeepAlive

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-59287

Affected Vendors & Products

Vendor	Product	Version / Range
spring	for_graphql	From 1.3.0 (inc) to 1.3.9 (inc)
spring	for_graphql	From 1.4.0 (inc) to 1.4.6 (inc)
spring	for_graphql	From 2.0.0 (inc) to 2.0.4 (inc)
vmware	spring_for_graphql	From 2.0.0 (inc) to 2.0.4 (inc)
vmware	spring_for_graphql	From 1.4.0 (inc) to 1.4.6 (inc)
vmware	spring_for_graphql	From 1.3.0 (inc) to 1.3.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. This occurs if an application uses WebSocketGraphQlClient to query a GraphQL API, has keepAlive configured, and an attacker can interfere with the WebSocket connection. The attacker could exhaust the application's memory, causing a DoS.

Detection Guidance

Detecting this vulnerability requires checking if your system uses Spring for GraphQL with WebSocketGraphQlClient and keepAlive enabled. Inspect application logs for WebSocket connections and memory usage patterns. Monitor for unusual memory consumption or crashes in applications using affected versions.

Impact Analysis

This vulnerability could allow an attacker to crash your application by consuming all available memory. This would make your service unavailable to legitimate users, leading to downtime and potential data loss.

Mitigation Strategies

Upgrade to fixed versions immediately: Spring for GraphQL 2.0.5 (OSS), 2.0.4.1 (Enterprise), 1.4.7 (Enterprise), or 1.3.10 (Enterprise). No other mitigation is required beyond upgrading. Disable keepAlive on WebSocketGraphQlClient if upgrading is not possible.

Hi! I’m here to help you understand CVE-2026-59287. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70