CVE-2026-41699: Spring for GraphQL Unsafe Deserialization Vulnerability
Summary
CVE-2026-41699: Spring for GraphQL: Unsafe Deserialization. Affects org.springframework.graphql:spring-graphql across 3 version ranges.
>= 1.3.0, <= 1.3.8
>= 1.4.0, < 1.4.6
>= 2.0.0, < 2.0.4
Fixed in 1.4.6 or 2.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring for GraphQL is a framework that simplifies the development of GraphQL APIs in Java applications. It provides features such as data fetching, pagination, and integration with Spring's ecosystem. However, certain versions of this package are susceptible to unsafe deserialization, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the way Spring for GraphQL processes paginated GraphQL queries. An attacker can exploit this by crafting a malicious GraphQL request that targets the deserialization process. If the application exposes a paginated (Connection) field and the classpath contains specific classes, it can lead to Remote Code Execution (RCE). This vulnerability is particularly dangerous as it allows attackers to execute arbitrary code on the server, potentially compromising sensitive data and the integrity of the application.
How To Fix
Latest published version: 2.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.4.0, < 1.4.61.4.6 -
>= 2.0.0, < 2.0.42.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize GraphQL requests and restrict the types of queries that can be processed. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The CVE-2026-41699 vulnerability in Spring for GraphQL poses a significant risk due to unsafe deserialization, which can lead to Remote Code Execution. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for org.springframework.graphql:spring-graphql →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Affected versions include Spring for GraphQL 2.0.0 through 2.0.3, 1.4.0 through 1.4.5, and 1.3.0 through 1.3.8.
Exploitation can lead to Remote Code Execution, allowing attackers to execute arbitrary code on the server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the pom.xml file. Visit Vulert Scanner to check your application without signup.
Implement input validation to sanitize GraphQL requests and restrict the types of queries that can be processed.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.graphql:spring-graphql.
