CVE-2026-59287 Spring for GraphQL WebSocket Client Denial of Service
Attackers can cause denial of service in Spring for GraphQL applications using WebSocket clients with keepAlive enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59287?
CVE-2026-59287 is a medium-severity denial of service vulnerability in Spring for GraphQL, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9
Weakness: CWE-770
Which versions are affected by CVE-2026-59287?
It affects 1 product.
Products include Vmware Spring for Graphql.
How do I fix CVE-2026-59287?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59287 being exploited?
There is no known exploitation of CVE-2026-59287 in the wild and no public exploit code.
Other vulnerabilities in Spring for GraphQL
- CVE-2026-59285 Spring for GraphQL Unsafe Deserialization in pagination support
- CVE-2026-59286 Spring for GraphQL loads Untrusted Resources in GraphiQL support
- CVE-2026-41699 Unsafe Deserialization in Spring GraphQL
- CVE-2026-41700 Cross-Site WebSocket Hijacking in Spring for GraphQL
- CVE-2026-59288 Spring for GraphQL Information Exposure in GraphiQL support
Sources
Also known as CLSA-2026-1791367893, CLSA-2026-1791825433, CLSA-2026-1791827348, GHSA-ch79-c8j8-qqf6.