CVE-2026-41699

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3

Description Applications are susceptible to unsafe deserialization when processing paginated GraphQL queries. This occurs when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. An attacker can craft a malicious GraphQL request to achieve remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.