CVE-2026-59289 is a high severity denial of service in Spring for GraphQL. Spring Data pagination forwards client-supplied values to the repository, so a forged query for a Connection field can exhaust memory or load the datastore. Fixed in 2.0.5, with enterprise fixes 2.0.4.1, 1.4.7 and 1.3.10.
What's affected
- Product: Spring for GraphQL, versions 2.0.0 to 2.0.4, 1.4.0 to 1.4.6 and 1.2.0 to 1.3.9.
- Fixed: 2.0.5 (open source). Enterprise Support only: 2.0.4.1, 1.4.7 and 1.3.10.
- Exposed: applications that expose a Connection typed Query field backed by a Spring Data repository through auto registration support, for example QueryByExampleDataFetcher or QuerydslDataFetcher, and that do not enforce query complexity checks.
- No further mitigation is listed beyond upgrading.
How to check if you're exposed
Find the Spring for GraphQL version your application resolves.
./mvnw dependency:tree -Dincludes=org.springframework.graphql
./gradlew dependencies --configuration runtimeClasspath | grep -i spring-graphql
Remember that Spring Boot manages this version for you in many projects, so check the resolved version rather than only your own build file.
Then search your code for the data fetchers named in the advisory.
grep -rn "QueryByExampleDataFetcher\|QuerydslDataFetcher" src
If you register Connection fields from Spring Data repositories this way, the pagination arguments come straight from clients. Check whether you apply a maximum page size or a complexity limit in front of them.
What to do now
- Upgrade to Spring for GraphQL 2.0.5, or the enterprise fixed version for your line.
- Set a hard maximum for page sizes and cap the cost of any single query.
- Add GraphQL query complexity and depth limits at the gateway or in the application.
- Put timeouts on repository queries, and alert on slow queries against the datastore.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-770 (Allocation of Resources Without Limits or Throttling). The advisory says the pagination support resolves arguments of a scrollable query and forwards the client values to the repository. A forged query for a Connection field can then ask for far more than the application is meant to serve.
The effect is either memory exhaustion in the application or long, heavy load on the database. Because the requester needs no privileges, this is a cheap attack against any public GraphQL API using the affected feature. The record scores it 7.5 (High) and does not mark it as exploited in the wild.
Try it yourself
Four Spring for GraphQL advisories landed at once. This demo shows how a vulnerability management view groups and prioritizes findings like these.
Click through it at your own pace, or open it full screen.
Quick check
Does upgrading remove the need for query limits?
No. The affected condition includes not enforcing additional query complexity checks. Limits are a good defence for any GraphQL API.
Sources
Last reviewed: 18 October 2026.
