CVE-2026-59285: Spring for GraphQL Unsafe Deserialization in pagination support

Q: Which deployments are affected?

The affected versions are Spring for GraphQL 2.0.0 through 2.0.4. The issue applies when the application processes paginated GraphQL queries.

Q: What application behavior is involved in exploitation?

An attacker would need to submit a paginated GraphQL query that reaches the vulnerable pagination processing path. The provided information does not specify authentication requirements, required schema features, or other preconditions.

Published Aug 27, 2026

Updated

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

Affected Software

1 affected component

Pivotal Spring for GraphQL>=2.0.0<=2.0.4

Event History

Aug 27, 2026

CVE Published

via MITRE·05:57 PM

Data Sourced

via MITRE·05:57 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

Description

Frequently Asked Questions

Which deployments are affected?

The affected versions are Spring for GraphQL 2.0.0 through 2.0.4. The issue applies when the application processes paginated GraphQL queries.

What application behavior is involved in exploitation?

An attacker would need to submit a paginated GraphQL query that reaches the vulnerable pagination processing path. The provided information does not specify authentication requirements, required schema features, or other preconditions.