CVE-2026-59289
Spring for GraphQL Denial of Service via pagination support
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9
- Record
CVE-2026-59289- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE List
Spring for GraphQL Denial of Service via pagination support
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9
- Record
CVE-2026-59289- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-67178
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9
- Record
EUVD-2026-67178- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ffhp-m2c7-jv8h
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and...
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9
- Record
GHSA-ffhp-m2c7-jv8h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVCLSA-2026-1786693842 No score
TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (6 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1786693842- Updated
- 2026-11-02
OSVCLSA-2026-1788806164 No score
TuxCare security update for org.springframework.graphql:spring-graphql (3 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 3 CVEs. Fixed in 1.4.6-tuxcare.1.
- Record
CLSA-2026-1788806164- Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1788870312 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.3.5-tuxcare.3.
- Record
CLSA-2026-1788870312- Updated
- 2026-11-02
OSVCLSA-2026-1788873403 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.2.9-tuxcare.5.
- Record
CLSA-2026-1788873403- Updated
- 2026-11-02
OSVCLSA-2026-1789150088 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1789150088- Updated
- 2026-11-02
OSVCLSA-2026-1791826672 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.2.4-tuxcare.1.
- Record
CLSA-2026-1791826672- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 3 CVEs |
1.4.6 up to 1.4.6-tuxcare.1 | 1.4.6-tuxcare.1 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 5 CVEs |
1.3.5 up to 1.3.5-tuxcare.3, plus listed versions 1.3.5-tuxcare.11.3.5-tuxcare.2 |
1.3.5-tuxcare.3 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 5 CVEs |
1.2.9 up to 1.2.9-tuxcare.5, plus listed versions 1.2.9-tuxcare.11.2.9-tuxcare.21.2.9-tuxcare.31.2.9-tuxcare.4 |
1.2.9-tuxcare.5 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 6 CVEs |
1.3.7 up to 1.3.7-tuxcare.4, plus listed versions 1.3.7-tuxcare.11.3.7-tuxcare.21.3.7-tuxcare.3 |
1.3.7-tuxcare.4 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 6 CVEs |
1.2.4 up to 1.2.4-tuxcare.1 | 1.2.4-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59289 is a high vulnerability (CVSS 7.5) in Spring For Graphql, published August 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. No source names a fixed version.