CVE-2026-59287

About vulnerability

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.

More precisely, an application is vulnerable when all the following are true:

• the application is using the WebSocketGraphQlClient to query a GraphQL API
• the keepAlive option is configured on the client
• the attacker can interfere with the WebSocket connection

When all the conditions above are met, an attacker may exhaust application memory, resulting in a Denial of Service. For this, the attacker needs to control the GraphQL server or perform a Man-in-the-Middle attack on the WebSocket connection.

Affected product:

Spring

Affected packages:

Spring Boot @ 3.3.13 (+459 more)