CVE-2026-59285: CWE-502 Deserialization of Untrusted Data in Spring Spring for GraphQL

CVE-2026-59285 describes an unsafe deserialization vulnerability in Spring for GraphQL versions 2.0.0 to 2.0.4. The flaw occurs during the processing of paginated GraphQL queries, allowing untrusted data to be deserialized unsafely. This can lead to severe consequences including full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). No known exploits are reported in the wild, and no vendor remediation or patch has been published as of the data provided.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code or cause denial of service, resulting in complete compromise of the affected application’s confidentiality, integrity, and availability. The CVSS score of 8.1 reflects the high impact potential of this flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds such as disabling or restricting the use of paginated GraphQL queries if possible, and monitoring for unusual activity related to GraphQL query processing.