CVE-2026-41699 is a high severity unsafe deserialization flaw (CVSS 8.1) in Spring for GraphQL. A crafted request to a paginated field can lead to remote code execution under specific conditions. Upgrade to 2.0.4, 1.4.6 or 1.3.9, depending on your line.
What's affected
Per the Spring security advisory, these versions are affected: Spring for GraphQL 2.0.0 to 2.0.3, 1.4.0 to 1.4.5, and 1.2.0 to 1.3.8.
Fixed versions:
- 2.0.4 (open source), 2.0.3.1 (Enterprise Support only)
- 1.4.6 (open source), 1.4.5.1 (Enterprise Support only)
- 1.3.9 (Enterprise Support only)
An application is vulnerable only if all three hold: it uses Spring GraphQL, it exposes a paginated Connection field, and its classpath has specific classes that can run unintended logic during instantiation or deserialization.
How to check if you're exposed
mvn dependency:tree | grep spring-graphql
gradle dependencies | grep spring-graphql
Check the resolved version against the lists above. Then look at your GraphQL schema for Connection types, which the Relay cursor pagination style produces, and consider what libraries sit on your classpath. A dependency scan can show the version in each repository.
What to do now
- Upgrade to the fixed version for your line.
- If you are on 1.3.x without Enterprise Support, plan a move to 1.4.6 or 2.0.4, since 1.3.9 is only listed for Enterprise Support customers.
- Spring says no further mitigation steps are necessary beyond upgrading.
- Rebuild and redeploy, and confirm the version at runtime.
- Review which libraries you carry on the classpath, and remove unused ones to reduce the pool of gadget classes.
Why it matters
The record lists CWE-502, deserialization of untrusted data. Pagination cursors are opaque strings sent by the client and read back by the server. If the server decodes them with a mechanism that can create arbitrary objects, a crafted cursor becomes input to that mechanism.
The vector marks attack complexity as high because success depends on suitable classes on the classpath. That is typical of deserialization bugs: your dependency list sets the risk. The Spring advisory says the issue was discovered internally. The record does not flag this CVE as known exploited.
Quick check
We do not use pagination. Are we safe?
The advisory makes a paginated Connection field one of the conditions. Without one, the path is not reachable, but upgrade anyway.
Sources
Last reviewed: 19 October 2026.
