---
title: "Spring for GraphQL CVE-2026-59285: Pagination RCE Risk"
url: https://erroneo.us/security/briefs/spring-for-graphql-cve-2026-59285-deserialization/
description: "Unsafe deserialization in Spring for GraphQL 2.0.0-2.0.4 pagination can enable RCE under specific conditions. Fixed in 2.0.5 (Boot 4.0.8/4.1.1). Check exposure."
type: security-brief
section: "Security Digest"
date_published: 2026-08-20
date_modified: 2026-09-02
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-59285"]
severity: "high"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Spring for GraphQL CVE-2026-59285: Pagination RCE Risk

**Verdict: Check exposure.** Only Spring Boot 4 apps on Spring for GraphQL 2.0.0-2.0.4 that use Jackson 2.x and expose paginated Connection fields are at risk; if that is you, take the 2.0.5 upgrade now.

- **Who must act:** Teams running Spring for GraphQL 2.0.0 through 2.0.4 (Spring Boot 4.0.x before 4.0.8, or 4.1.0) with Jackson 2.x JSON handling and at least one paginated (Connection) field.
- **Who can relax:** Spring Boot 3.x apps on Spring for GraphQL 1.x (outside the listed range), GraphQL APIs with no Connection fields, and apps not using Jackson 2.x; upgrade on a normal cycle.
- **Affected:** Spring for GraphQL 2.0.0 through 2.0.4; Spring Boot 4.0.0 through 4.0.7 and 4.1.0 (which manage spring-graphql 2.0.0-2.0.4)
- **Fixed:** Spring for GraphQL 2.0.5 (OSS); Spring for GraphQL 2.0.4.1 (Enterprise Support only); Spring Boot 4.0.8 and 4.1.1 (manage spring-graphql 2.0.5)
- **CVEs:** CVE-2026-59285
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Find the resolved spring-graphql version in every service (mvn dependency:tree or gradle dependencyInsight).
2. Upgrade to Spring Boot 4.0.8 / 4.1.1 or later, or override spring-graphql.version to 2.0.5.
3. Check whether the app uses Jackson 2.x (com.fasterxml.jackson.core:jackson-databind) and exposes Connection fields; prioritize those services.
4. If an upgrade must wait, consider disabling or gating paginated fields for unauthenticated clients; Spring lists no official workaround.
5. Rebuild and redeploy; confirm the running artifact contains spring-graphql-2.0.5.jar or later.

### How to check if you are affected

- Run ./mvnw dependency:tree -Dincludes=org.springframework.graphql:spring-graphql or ./gradlew dependencyInsight --dependency spring-graphql and compare against 2.0.5.
- Scan built JARs and SBOMs for spring-graphql-2.0.[0-4].jar.
- Review GraphQL request logs for unusual or oversized pagination cursor arguments (after/before) and for errors from JSON deserialization during paginated queries.

## What happened

On August 20, 2026, the Spring team published [CVE-2026-59285](https://spring.io/security/cve-2026-59285), an unsafe deserialization flaw ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)) in Spring for GraphQL's pagination support. Spring rates it High. The advisory says that when four conditions are all met, "an attacker can craft a malicious GraphQL request that can lead to Remote Code Execution". The conditions:

- the application uses Spring for GraphQL;
- it uses Jackson 2.x for JSON deserialization;
- it exposes a paginated (Connection) field;
- its classpath "contains specific classes that can be leveraged to execute unintended logic".

The fix is Spring for GraphQL 2.0.5, published to [Maven Central](https://repo1.maven.org/maven2/org/springframework/graphql/spring-graphql/maven-metadata.xml) the same day. A 2.0.4.1 build is available to Enterprise Support customers only. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-59285) went live on August 27. CISA's enrichment scores it CVSS 3.1 8.1 (`AV:N/AC:H/PR:N/UI:N`) and lists exploitation as "none" and automatable as "no". Spring has not published a credit, a proof of concept or the gadget classes involved.

## Who is affected

Only Spring for GraphQL 2.0.0 through 2.0.4. According to the project's [versions table](https://github.com/spring-projects/spring-graphql/wiki/Spring-for-GraphQL-Versions), that is the generation used by Spring Boot 4.0.x and 4.1.x. Boot's dependency management pins the version for you. Boot 4.0.7 and 4.1.0 manage 2.0.4, and Boot [4.0.8](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/4.0.8/spring-boot-dependencies-4.0.8.pom) and [4.1.1](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/4.1.1/spring-boot-dependencies-4.1.1.pom), released August 20, move to 2.0.5. Spring Boot 3.5.x uses Spring for GraphQL 1.4.x, which this advisory does not list as affected.

## Do you really need to act?

Only if your service matches every condition, and that is a real filter. "High complexity" in the score reflects the need for a usable gadget class on the classpath. Many applications won't have one, but large dependency trees often do, and you can't easily prove a negative. Work through it in this order:

- **Spring Boot 3.x / Spring for GraphQL 1.x:** not in the affected range. No action needed for this CVE.
- **Boot 4 with no Connection fields** in your schema: the vulnerable path is not exposed. Upgrade on your normal cycle.
- **Boot 4, Connection fields and Jackson 2.x:** treat this as an unauthenticated RCE candidate on any internet-facing GraphQL endpoint, and upgrade this week.

The upgrade itself is low risk. It is a patch release, and Spring says no further mitigation is needed once you are on a fixed version.

## What to do now

1. Find the resolved version: `./mvnw dependency:tree -Dincludes=org.springframework.graphql:spring-graphql` or `./gradlew dependencyInsight --dependency spring-graphql`.
2. Upgrade Spring Boot to 4.0.8 or 4.1.1 or later. If you can't move Boot yet, override the managed version: in Maven set `<spring-graphql.version>2.0.5</spring-graphql.version>` in `<properties>`; in Gradle set `ext['spring-graphql.version'] = '2.0.5'`.
3. Check which Jackson line your app uses for GraphQL JSON: `./mvnw dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind`. Then search your schema for `Connection` types to rank services.
4. If a release has to wait, restrict paginated fields to authenticated callers at the gateway. Spring lists no workaround, so treat this as a stopgap only.
5. Rebuild, redeploy, and confirm the running artifact contains `spring-graphql-2.0.5.jar` or later.

## How to tell if you were hit

No exploitation has been reported, and no public exploit was known as of September 2. Spring has not published indicators. Look in GraphQL access logs for paginated queries with unusual or very long `after`/`before` cursor values, and for clusters of deserialization or type errors from those queries. Successful gadget-chain RCE usually shows up as the JVM process spawning shells or making unexpected outbound connections, so review EDR and egress logs for the GraphQL service.

## Timeline

- Jul 4, 2026 — CVE-2026-59285 reserved.
- Aug 20, 2026 — Spring publishes the advisory. Spring for GraphQL 2.0.5 and Spring Boot 4.0.8 and 4.1.1 are released to Maven Central.
- Aug 27, 2026 — The CVE record is published.
- Sep 2, 2026 — CISA adds its enrichment: CVSS 3.1 8.1, exploitation none.

## Sources

1. [Spring — CVE-2026-59285: Spring for GraphQL Unsafe Deserialization in pagination support](https://spring.io/security/cve-2026-59285)
2. [CVE record — CVE-2026-59285](https://www.cve.org/CVERecord?id=CVE-2026-59285)
3. [Maven Central — org.springframework.graphql:spring-graphql versions](https://repo1.maven.org/maven2/org/springframework/graphql/spring-graphql/maven-metadata.xml)
4. [Maven Central — spring-boot-dependencies 4.0.8 POM](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/4.0.8/spring-boot-dependencies-4.0.8.pom)
5. [Maven Central — spring-boot-dependencies 4.1.1 POM](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/4.1.1/spring-boot-dependencies-4.1.1.pom)
6. [Spring for GraphQL wiki — Spring for GraphQL Versions](https://github.com/spring-projects/spring-graphql/wiki/Spring-for-GraphQL-Versions)
7. [MITRE — CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)

---
Source page: https://erroneo.us/security/briefs/spring-for-graphql-cve-2026-59285-deserialization/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt