{"id":"CVE-2026-59287","aliases":["CLSA-2026-1791367893","CLSA-2026-1791825433","CLSA-2026-1791827348","CLSA-2026-1794248921","EUVD-2026-67176","GHSA-ch79-c8j8-qqf6"],"status":"published","title":"Spring for GraphQL WebSocket Client Denial of Service","description":"Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.3.0 - 1.3.9","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00367,"percentile":0.30903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-08-27T17:57:45Z","modified":"2026-11-10T01:15:05Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"org.springframework.graphql:spring-graphql","fixed_in":["1.3.5-tuxcare.6","1.3.7-tuxcare.6","1.4.6-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.graphql:spring-graphql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.5"},{"fixed":"1.3.5-tuxcare.6"}]}],"versions":["1.3.5","1.3.5-tuxcare.1","1.3.5-tuxcare.2","1.3.5-tuxcare.3","1.3.5-tuxcare.4","1.3.5-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.graphql:spring-graphql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.7"},{"fixed":"1.3.7-tuxcare.6"}]}],"versions":["1.3.7","1.3.7-tuxcare.1","1.3.7-tuxcare.2","1.3.7-tuxcare.3","1.3.7-tuxcare.4","1.3.7-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.graphql:spring-graphql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.6"},{"fixed":"1.4.6-tuxcare.2"}]}],"versions":["1.4.6","1.4.6-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.graphql:spring-graphql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.6"},{"fixed":"1.3.6-tuxcare.2"}]}],"versions":["1.3.6","1.3.6-tuxcare.1"],"bundled":6}],"products":[{"vendor":"spring","product":"spring for graphql"},{"vendor":"vmware","product":"spring_for_graphql"}],"references":[{"url":"https://spring.io/security/cve-2026-59287","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59287"},{"url":"https://github.com/advisories/GHSA-ch79-c8j8-qqf6"}],"sources":{"cve":[{"id":"CVE-2026-59287","title":"Spring for GraphQL WebSocket Client Denial of Service","description":"Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.3.0 - 1.3.9","status":"published","published":"2026-08-27T17:57:45.951Z","modified":"2026-09-02T16:33:55.633Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-67176","description":"Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.3.0 - 1.3.9","status":"published","published":"2026-08-27T17:57:45Z","modified":"2026-09-02T16:33:55Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:15.092584Z"}],"ghsa":[{"id":"GHSA-ch79-c8j8-qqf6","title":"Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client...","description":"Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.3.0 - 1.3.9","status":"published","published":"2026-08-27T21:31:42Z","modified":"2026-08-31T21:32:54Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:11:12.60039Z"}],"nvd":[{"id":"CVE-2026-59287","description":"Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.\nSpring for GraphQL 2.0.0 - 2.0.4\nSpring for GraphQL 1.4.0 - 1.4.6\nSpring for GraphQL 1.3.0 - 1.3.9","status":"published","published":"2026-08-27T20:17:54.913Z","modified":"2026-09-02T17:17:47.89Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CLSA-2026-1791367893","title":"TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)","description":"TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.3.5-tuxcare.6.","status":"published","published":"2026-10-07T10:11:33Z","modified":"2026-10-15T09:45:38.046999353Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791825433","title":"TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)","description":"TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.3.7-tuxcare.6.","status":"published","published":"2026-10-12T17:17:13Z","modified":"2026-11-02T19:46:27.188206413Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791827348","title":"TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)","description":"TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.4.6-tuxcare.2.","status":"published","published":"2026-10-12T17:49:08Z","modified":"2026-11-02T19:46:27.288309238Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1794248921","title":"TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)","description":"TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.6-tuxcare.2.","status":"published","published":"2026-11-09T19:28:42Z","modified":"2026-11-10T01:15:05.397136472Z","updated_at":"2026-11-10T01:43:20.132342Z"}]}}