CVE-2026-41699— Unsafe Deserialization in Spring GraphQL
Quick assessment
Affected
Spring Spring for GraphQL
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
VMware Spring for GraphQL是美国威睿（VMware）公司的一个GraphQL应用开发框架。 VMware Spring for GraphQL 2.0.0及之前版本、1.4.0及之前版本和1.3.0及之前版本存在代码问题漏洞，该漏洞源于处理分页GraphQL查询时存在不安全反序列化，可能导致远程代码执行。
Possible ATT&CK Techniques 3 AI
T1195 · Supply Chain Compromise T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Spring | Spring for GraphQL | 2.0.0< 2.0.3.1 |
affected |
1.4.0< 1.4.5.1 |
affected | ||
1.3.0< 1.3.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-41699
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unsafe Deserialization in Spring GraphQL
Source: CVE Program / CVE List V5
Vulnerability Description
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions:
Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
VMware Spring for GraphQL 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Spring for GraphQL是美国威睿（VMware）公司的一个GraphQL应用开发框架。 VMware Spring for GraphQL 2.0.0及之前版本、1.4.0及之前版本和1.3.0及之前版本存在代码问题漏洞，该漏洞源于处理分页GraphQL查询时存在不安全反序列化，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring for GraphQL | 2.0.0 ~ 2.0.3.1 | - |
|
II. Public POCs for CVE-2026-41699
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41699
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-41699 (1)
Same Patch Batch · Spring · 2026-06-11 · 15 CVEs total
| CVE-2026-40999 | 8.6 HIGH | Spring WS SSRF via unvalidated WS-Addressing reply destinations |
| CVE-2026-40994 | 8.2 HIGH | Wss4jSecurityInterceptor disables WS-I BSP validation by default |
| CVE-2026-40998 | 8.2 HIGH | Jaxp13 XPath XXE via StreamSource and SAXSource |
| CVE-2026-41700 | 8.1 HIGH | Cross-Site WebSocket Hijacking in Spring for GraphQL |
| CVE-2026-41856 | 7.5 HIGH | Spring GraphQL Annotation Detection Vulnerability |
| CVE-2026-40987 | 7.1 HIGH | Remote-file synchronizer in Spring Integration writes server-supplied filename under local |
| CVE-2026-40985 | 6.4 MEDIUM | Data Binding Vulnerability in Spring Web Flow with Unified EL Parser |
| CVE-2026-40995 | 5.4 MEDIUM | X.509 authentication bypasses Spring Security account checks |
| CVE-2026-40997 | 5.3 MEDIUM | SOAP security faults leak Spring Security account state |
| CVE-2026-41001 | 5.3 MEDIUM | Predictable Temp Directory in Artemis Auto-configuration |
| CVE-2026-40992 | 5.0 MEDIUM | Mail Auto-Configuration Does Not Enable SSL Hostname Verification |
| CVE-2026-40986 | 4.8 MEDIUM | Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML |
| CVE-2026-40996 | 4.8 MEDIUM | Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default |
| CVE-2026-41000 | 3.7 LOW | WSS4J validation does not use configured replay cache |
IV. Related Vulnerabilities
Same product: Spring for GraphQL
-
CVE-2026-59289
Spring for GraphQL Denial of Service via pagination support -
CVE-2026-59288
Spring for GraphQL Information Exposure in GraphiQL support -
CVE-2026-59287
Spring for GraphQL WebSocket Client Denial of Service -
CVE-2026-59286
Spring for GraphQL loads Untrusted Resources in GraphiQL sup -
CVE-2026-59285
Spring for GraphQL Unsafe Deserialization in pagination supp
Same vendor: Spring
-
CVE-2026-59324
fluxTransform shared RequestMessageHolder causes cross-messa -
CVE-2026-59322
EmbeddedHeadersJsonMessageMapper default gives wire peer ful -
CVE-2026-59321
Shared JSR-223 ScriptEngine evaluated concurrently without T -
CVE-2026-59320
In Spring AMQP the link credit never replenished on listener -
CVE-2026-59319
RediSearch Tag Injection in RedisChatMemoryRepository Allows
Same weakness: CWE-502
-
CVE-2026-103877
Apache Directory LDAP API: Unsafe loading of Java code from -
CVE-2026-55083
DHIS2: Unsafe Java Deserialization - Remote Code Execution ( -
CVE-2026-12544
Foreman: ssti and insecure deserialization in foreman-rake c -
CVE-2026-97284
WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vu -
CVE-2026-94390
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5
V. Comments for CVE-2026-41699
No comments yet