CVE-2026-41699: Spring for GraphQL: Unsafe Deserialization

June 11, 2026 (updated August 21, 2026)

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.

Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.

References

github.com/advisories/GHSA-px92-q6rc-6mwv
github.com/spring-projects/spring-graphql/commit/5579b6eca045126a27405b4cb1ae1f38d7577cb7
nvd.nist.gov/vuln/detail/CVE-2026-41699
spring.io/security/cve-2026-41699

Code Behaviors & Features

Detect and mitigate CVE-2026-41699 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →