Executive brief
Spring for GraphQL is a framework for building GraphQL APIs on Java. Its Spring Data pagination feature can be exploited through malicious queries to consume excessive memory or overload the database backend, causing service unavailability for legitimate users. An attacker can trigger these attacks remotely without authentication.
Technical details
The vulnerability exists in Spring for GraphQL's pagination support for scrollable queries, which resolves client-supplied pagination arguments without sufficient validation and forwards them directly to the underlying Spring Data repository. An attacker can craft a GraphQL query with malicious pagination parameters to force the application to allocate excessive memory or generate resource-intensive database queries, resulting in denial of service. The attack is network-accessible and requires no authentication. Patches are available in Spring for GraphQL 1.4.7, 1.3.10, and 2.0.5 or later.
Affected products
- VMware Spring for GraphQL 1.2.0–1.3.9, 1.4.0–1.4.6, 2.0.0–2.0.4
Timeline
- 2026-08-27: disclosed