CVE-2026-59289 Spring for GraphQL Denial of Service via pagination support

High 7.5 Published 27 Aug 2026 Updated 2 Sep 2026

An attacker can cause denial of service by sending malicious GraphQL queries that exhaust memory or overload the datastore via pagination support.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-59289?

CVE-2026-59289 is a high-severity denial of service vulnerability in Spring for GraphQL, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9

Weakness: CWE-770

Which versions are affected by CVE-2026-59289?

It affects 1 product.

Products include Vmware Spring for Graphql.

How do I fix CVE-2026-59289?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-59289 being exploited?

There is no known exploitation of CVE-2026-59289 in the wild and no public exploit code.

Sources

Also known as GHSA-ffhp-m2c7-jv8h.