CVE-2026-59285

CVE-2026-59285 is an unsafe deserialization flaw (CWE-502) in Spring for GraphQL, triggered when the framework processes paginated GraphQL queries. Because the attack vector is network-based with no privileges or user interaction required, a remote, unauthenticated attacker can send a crafted paginated query, though the high attack complexity rating means successful exploitation depends on conditions specific to each deployment. A successful attack could compromise the confidentiality, integrity, and availability of the application, potentially including remote code execution, without gaining privileges beyond the application's own scope. Only applications built with Spring for GraphQL versions 2.0.0 through 2.0.4 are affected; other versions are not implicated in this advisory. No public proof of concept, CISA KEV listing, or known in-the-wild exploitation exists, and EPSS estimates the 30-day exploitation probability at about 0.5%.

What to do: Upgrade applications to a fixed Spring for GraphQL release beyond 2.0.4 per the vendor security advisory, and audit your dependency tree for spring-graphql versions 2.0.0 through 2.0.4. As an interim mitigation, require authentication and restrict network access to GraphQL endpoints, prioritizing internet-facing services, though the absence of a public PoC and the high attack complexity reduce urgency for internal deployments.