CVE-2026-59289

CVE-2026-59289 is a resource-exhaustion denial-of-service flaw (CWE-770) in the Spring Data pagination support of Spring for GraphQL, which resolves the arguments of a scrollable query and forwards client-supplied values directly to the underlying repository. An unauthenticated attacker can send a specially crafted query against a GraphQL Connection field with abusive scroll values, causing the application to exhaust memory or placing significant, prolonged load on the backing datastore. The impact is availability-only (high on the 7.5 CVSS 3.1 score), with no confidentiality or integrity loss. Any Spring application running Spring for GraphQL 1.2.0-1.3.9, 1.4.0-1.4.6, or 2.0.0-2.0.4 that exposes Connection fields backed by Spring Data repositories is affected. There is currently no known public proof-of-concept, no CISA KEV listing, and a low EPSS of 0.3%, indicating no confirmed exploitation in the wild.

What to do: Upgrade Spring for GraphQL to a release outside the affected ranges — newer than 2.0.4 in the 2.0.x line, newer than 1.4.6 in the 1.4.x line, and newer than 1.3.9 in the 1.2/1.3 line — confirming exact fixed versions in the Spring/VMware advisory. As interim mitigation, cap and validate client-supplied scroll/pagination arguments (e.g., first/last/limit and scroll offsets) at the application or gateway layer and rate-limit unauthenticated GraphQL queries against Connection fields. Inventory services that expose GraphQL endpoints backed by Spring Data repositories, since only those applications are exploitable.