CVE-2026-59287: Spring for GraphQL WebSocket Client Denial of Service
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable WebSocket client keepAlive to mitigate the Denial of Service vulnerability in Spring for GraphQL.
Spring for GraphQL WebSocket Client keepAlive = false
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using the Spring for GraphQL WebSocket client with keepAlive enabled are exposed. The affected version ranges are 2.0.0 through 2.0.4, 1.4.0 through 1.4.6, and 1.3.0 through 1.3.9.
Is a WebSocket client without keepAlive affected?
The provided advisory identifies the issue specifically when the WebSocket client is used with keepAlive enabled. It does not state that configurations without keepAlive are affected.