Executive brief
Spring for GraphQL is a framework that enables GraphQL query processing in Spring applications. A vulnerability in how it deserializes paginated GraphQL queries allows attackers to execute arbitrary code, potentially compromising application servers and accessing sensitive data. Applications using Spring for GraphQL 2.0.0 through 2.0.4 are affected.
Technical details
The vulnerability is a unsafe deserialization flaw triggered during the processing of paginated GraphQL queries. The vulnerable component handles query pagination parameters without proper validation, allowing attackers to inject malicious serialized objects that execute arbitrary code upon deserialization. This is a network-reachable attack requiring the attacker to send crafted GraphQL queries to an affected endpoint; no authentication is typically required for GraphQL query execution. Successful exploitation results in remote code execution with the privileges of the application process. A patch is expected to address versions 2.0.0 through 2.0.4.
Affected products
- VMware Spring for GraphQL 2.0.0 to 2.0.4
Timeline
- 2026-08-27: disclosed