Loading vulnerability…
Unsafe Deserialization RCE in Spring for GraphQL Paginated Queries
CVE-2026-41699 is an unsafe deserialization vulnerability in Spring for GraphQL pagination handling. A malicious GraphQL request targeting a paginated Connection field can cause deserialization or instantiation of attacker-controlled types when usable classes are present on the application classpath. This may enable remote code execution. Affected versions are Spring for GraphQL 2.0.0 through 2.0.3, 1.4.0 through 1.4.5, and 1.3.0 through 1.3.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may permit an unauthenticated remote attacker to execute arbitrary code in the context of the affected Spring for GraphQL application, resulting in complete compromise of confidentiality, integrity, and availability for the application and potentially its accessible resources.
If you can’t patch tonight, do this now.
No vendor-supported workaround is identified beyond upgrading. Until patching is complete, restrict access to GraphQL endpoints that expose paginated Connection fields and remove unnecessary classes from the application classpath that could be usable as deserialization gadgets, where operationally feasible.
Patch, then assume compromise.
Upgrade Spring for GraphQL to a fixed release: 2.0.4 for the 2.0.x line, 1.4.6 for the 1.4.x line, or 1.3.9 where commercially available. Deploy the updated dependency and rebuild and redeploy affected applications.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.