CVE-2026-41699— Unsafe Deserialization in Spring GraphQL
Possible ATT&CK Techniques 3AI
T1195 · Supply Chain Compromise T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Spring | Spring for GraphQL | 2.0.0< 2.0.3.1 | affected |
1.4.0< 1.4.5.1 | affected | ||
1.3.0< 1.3.9 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41699
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unsafe Deserialization in Spring GraphQL
Source: NVD (National Vulnerability Database)
Vulnerability Description
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
可信数据的反序列化
Source: NVD (National Vulnerability Database)
Vulnerability Title
VMware Spring for GraphQL 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Spring for GraphQL是美国威睿（VMware）公司的一个GraphQL应用开发框架。 VMware Spring for GraphQL 2.0.0及之前版本、1.4.0及之前版本和1.3.0及之前版本存在代码问题漏洞，该漏洞源于处理分页GraphQL查询时存在不安全反序列化，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring for GraphQL | 2.0.0 ~ 2.0.3.1 | - |
II. Public POCs for CVE-2026-41699
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41699
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-41699 (1)
Same Patch Batch · Spring · 2026-06-11 · 15 CVEs total
| CVE-2026-40999 | 8.6 HIGH | Spring WS SSRF via unvalidated WS-Addressing reply destinations |
| CVE-2026-40998 | 8.2 HIGH | Jaxp13 XPath XXE via StreamSource and SAXSource |
| CVE-2026-40994 | 8.2 HIGH | Wss4jSecurityInterceptor disables WS-I BSP validation by default |
| CVE-2026-41700 | 8.1 HIGH | Cross-Site WebSocket Hijacking in Spring for GraphQL |
| CVE-2026-41856 | 7.5 HIGH | Spring GraphQL Annotation Detection Vulnerability |
| CVE-2026-40987 | 7.1 HIGH | Remote-file synchronizer in Spring Integration writes server-supplied filename under local |
| CVE-2026-40985 | 6.4 MEDIUM | Data Binding Vulnerability in Spring Web Flow with Unified EL Parser |
| CVE-2026-40995 | 5.4 MEDIUM | X.509 authentication bypasses Spring Security account checks |
| CVE-2026-41001 | 5.3 MEDIUM | Predictable Temp Directory in Artemis Auto-configuration |
| CVE-2026-40997 | 5.3 MEDIUM | SOAP security faults leak Spring Security account state |
| CVE-2026-40992 | 5.0 MEDIUM | Mail Auto-Configuration Does Not Enable SSL Hostname Verification |
| CVE-2026-40996 | 4.8 MEDIUM | Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default |
| CVE-2026-40986 | 4.8 MEDIUM | Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML |
| CVE-2026-41000 | 3.7 LOW | WSS4J validation does not use configured replay cache |
IV. Related Vulnerabilities
Same vendor: Spring
- CVE-2026-41862
Spring Statemachine 反序列化注入漏洞 - CVE-2026-47825
Spring Cloud Gateway Server Forwards Headers from Untrusted - CVE-2026-41708
Spring Cloud Sleuth instrumentation of Spring TX DoS vulnera - CVE-2026-47835
Spring AI vector store metadata filtering to handle special - CVE-2026-41856
Spring GraphQL Annotation Detection Vulnerability
Same weakness: CWE-502
- CVE-2026-24232
NVIDIA Transformers4Rec反序列化漏洞致代码执行 - CVE-2026-64606
Apache Fory, Apache Fory: Class-registration bypass through - CVE-2026-63767
ktransformers Unauthenticated Pickle Deserialization RCE via - CVE-2026-28220
Wazuh cluster DAPI arbitrary callable deserialization and RB - CVE-2026-12484
Unsafe Deserialization in keras.layers.TorchModuleWrapper.fr
V. Comments for CVE-2026-41699
No comments yet