CVE-2026-59287

Published September 3, 2026

CVSS 3.15.9

SeverityMedium

Known exploitedNo

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.
Spring for GraphQL 2.0.0 – 2.0.4
Spring for GraphQL 1.4.0 – 1.4.6
Spring for GraphQL 1.3.0 – 1.3.9

NVD references:

https://spring.io/security/cve-2026-59287

Primary source: NIST National Vulnerability Database

Stay Ahead of the Threat Landscape