CVE-2026-41699
Unsafe Deserialization in Spring GraphQL
CVE-2026-41699 is a high vulnerability (CVSS 8.1) in Spring For Graphql, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in org.springframework.graphql:spring-graphql 2.0.4.
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unsafe Deserialization in Spring GraphQL
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
- Record
CVE-2026-41699- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2026-36212
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
- Record
EUVD-2026-36212- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-px92-q6rc-6mwv
Spring for GraphQL: Unsafe Deserialization
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
- Record
GHSA-px92-q6rc-6mwv- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
- Record
CVE-2026-41699- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Unsafe Deserialization in Spring GraphQL
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
- Record
CVE-2026-41699- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-px92-q6rc-6mwv
Spring for GraphQL: Unsafe Deserialization
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
- Record
GHSA-px92-q6rc-6mwv- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Show 6 moreShow less
OSVCLSA-2026-1786693842 No score
TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (6 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1786693842- Updated
- 2026-11-02
OSVCLSA-2026-1788870312 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.3.5-tuxcare.3.
- Record
CLSA-2026-1788870312- Updated
- 2026-11-02
OSVCLSA-2026-1788873403 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.2.9-tuxcare.5.
- Record
CLSA-2026-1788873403- Updated
- 2026-11-02
OSVCLSA-2026-1789150088 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1789150088- Updated
- 2026-11-02
OSVCLSA-2026-1791826672 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.2.4-tuxcare.1.
- Record
CLSA-2026-1791826672- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-41699 No score
CVE-2026-41699 in org.springframework.graphql:spring-graphql - Patched by Root
Root has patched CVE-2026-41699 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41699- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.graphql:spring-graphqlMaven |
2.0.0 to 2.0.3 | 2.0.4 |
org.springframework.graphql:spring-graphqlMaven |
1.4.0 to 1.4.5 | 1.4.6 |
org.springframework.graphql:spring-graphqlMaven |
1.3.0 to 1.3.8 | None known |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.3.5 up to 1.3.5-tuxcare.3, plus listed versions 1.3.5-tuxcare.11.3.5-tuxcare.2 |
1.3.5-tuxcare.3 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.2.9 up to 1.2.9-tuxcare.5, plus listed versions 1.2.9-tuxcare.11.2.9-tuxcare.21.2.9-tuxcare.31.2.9-tuxcare.4 |
1.2.9-tuxcare.5 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.3.7 up to 1.3.7-tuxcare.4, plus listed versions 1.3.7-tuxcare.11.3.7-tuxcare.21.3.7-tuxcare.3 |
1.3.7-tuxcare.4 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.2.4 up to 1.2.4-tuxcare.1 | 1.2.4-tuxcare.1 |
org.springframework.graphql:spring-graphqlMaven |
2.0.0 up to 2.0.4, plus listed versions 2.0.12.0.22.0.3 |
2.0.4 |
org.springframework.graphql:spring-graphqlMaven |
1.4.0 up to 1.4.6, plus listed versions 1.4.11.4.21.4.31.4.41.4.5 |
1.4.6 |
org.springframework.graphql:spring-graphqlMaven |
1.3.0 to 1.3.8, plus listed versions 1.3.11.3.21.3.31.3.41.3.51.3.61.3.7 |
None known |
org.springframework.graphql:spring-graphqlRoot:Maven |
before 1.3.3-aikido.1 | 1.3.3-aikido.12.0.3-aikido.12.0.2-aikido.11.4.5-aikido.1 |
io.root.org.springframework.graphql:spring-graphqlRoot:Maven |
before 1.3.3-root.io.1 | 1.3.3-root.io.12.0.3-root.io.12.0.2-root.io.11.4.5-root.io.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-02 | affected | OSV |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
spring.io/security/cve-2026-41699
nvd.nist.gov/vuln/detail/CVE-2026-41699
github.com/spring-projects/spring-graphql/commit/5579b6eca045126a27405b4cb1ae1f38d7577cb7