CVE-2026-59285 is a high severity unsafe deserialization flaw in Spring for GraphQL 2.0.0 through 2.0.4. Under specific conditions a crafted request to a paginated Connection field can lead to remote code execution. The open source fix is Spring for GraphQL 2.0.5.
What's affected
- Product: Spring for GraphQL, versions 2.0.0 to 2.0.4.
- Fixed: 2.0.5 (open source) and 2.0.4.1 (Enterprise Support only).
- The Spring advisory says an application is vulnerable only when all of these are true: it uses Spring for GraphQL, it uses Jackson 2.x for JSON deserialization, it exposes a paginated Connection field, and its classpath contains specific classes that can be abused during instantiation or deserialization.
- No further mitigation is listed beyond upgrading.
How to check if you're exposed
Find the Spring for GraphQL version your application resolves.
./mvnw dependency:tree -Dincludes=org.springframework.graphql
./gradlew dependencies --configuration runtimeClasspath | grep -i spring-graphql
Remember that Spring Boot manages this version for you in many projects, so check the resolved version rather than only your own build file.
Then check the conditions in the advisory. Look for Connection return types in your GraphQL schema and controllers, and confirm which JSON library handles deserialization. The last condition, gadget classes on the classpath, is the hard one to judge by hand. An automated scan of your full dependency tree helps here.
What to do now
- Upgrade Spring for GraphQL to 2.0.5, or to 2.0.4.1 if you have Enterprise support.
- Check your dependency tree for libraries that are known deserialization gadget sources, and remove ones you do not need.
- Review which GraphQL fields accept pagination arguments from clients.
- Put request size and query depth limits in front of the endpoint.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-502 (Deserialization of Untrusted Data). Pagination support takes values from the client and turns them into objects, and under the conditions the advisory lists, that can instantiate classes the attacker picks.
The record scores it 8.1 (High) with high attack complexity, which fits the long list of conditions: the dangerous outcome needs the right classes on the classpath. Fewer applications meet every condition than use the library, but those that do should treat it as urgent because the outcome is remote code execution. The advisory lists no workaround other than upgrading. The record does not mark it as exploited in the wild. The Spring advisory shows a publication date of 20 August 2026, while the record's published date is 27 August 2026.
Try it yourself
Whether this flaw bites depends on conditions in your own application. This demo shows how an exploitability check narrows a list of CVEs to the ones that apply.
Click through it at your own pace, or open it full screen.
Quick check
Are all Spring for GraphQL 2.0.x users exposed to code execution?
No. Per the Spring advisory, all four conditions must hold, including a paginated Connection field, Jackson 2.x and specific classes on the classpath. Upgrade anyway, because the version range is easy to check and the fix is a patch release.
Sources
Last reviewed: 18 October 2026.
