CVE-2026-59285

CVE Enrichment

CVSS: 8.1 HIGH
EPSS: 0.44%
EPSS Percentile: 36.86%
CISA KEV: Not listed

Description

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 28-Aug-2026 03:17
Last Modified: 03-Sep-2026 02:17
EPSS Date: 2026-10-23
CWE: CWE-502

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

vmware / spring_for_graphql Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.0.0 · before (exclusive) 2.0.4.1
cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 02-Nov-2026 09:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Sonatype has highlighted two vulnerabilities: CVE-2026-59285, which it describes as a critical remote code execution issue in Spring for GraphQL, and CVE-2026-59318, a medium-severity issue in Spring AI’s tool-calling Spring Framework Updates Patch 91 Vulnerabilities

CVE (2)

Vendors (1)

Products (11)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.