CVE-2026-59287 Security Details

CVE ID

CVE-2026-59287

CWE

CWE-770

CVE Description

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

Published

Aug 20, 2026

CVSS Score & Severity

5.9Medium

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.367%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/graphql/client/WebSocketGraphQlTransport$GraphQlSessionHandler.handle(Lorg/springframework/web/reactive/socket/WebSocketSession;)Lreactor/core/publisher/Mono;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT