CVE-2026-59289
Received Received - Intake

Denial of Service in Spring for GraphQL via Malicious Pagination Queries

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-28
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-59289

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
spring for_graphql From 1.2.0 (inc) to 1.3.9 (inc)
spring for_graphql From 1.4.0 (inc) to 1.4.6 (inc)
spring for_graphql From 2.0.0 (inc) to 2.0.4 (inc)
spring for_graphql From 1.2.0 (inc) to 2.0.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Spring for GraphQL's pagination support. An attacker can craft a malicious query for a Connection field that tricks the system into processing scrollable query arguments. The system then forwards these client-supplied values to the underlying repository, which can consume excessive application memory or overload the datastore. This leads to a Denial of Service (DoS) condition.

Impact Analysis

If exploited, this vulnerability can cause your application to slow down significantly or crash entirely due to high memory usage or datastore load. This disrupts normal operations, potentially making services unavailable to legitimate users. It may also lead to increased operational costs from resource overuse.

Mitigation Strategies

Upgrade Spring for GraphQL to versions outside the affected ranges: 2.0.5 or later, 1.4.7 or later, or 1.3.10 or later. Disable scrollable queries or Connection fields if not required. Implement rate limiting and query complexity analysis to prevent excessive resource consumption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart