CVE-2026-59287 in Spring for GraphQL
Summary
by MITRE • 08/27/2026
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Spring for GraphQL versions ranging from 1.3.0 through 1.3.9, and 1.4.0 through 2.0.4, represents a significant Denial of Service risk specifically tied to the configuration of WebSocket clients with keep-alive mechanisms enabled. This flaw stems from an improper handling of connection lifecycle events where the application fails to adequately manage resource cleanup or rate limiting for persistent connections that remain idle but active due to the keep-alive setting. In these affected versions, the underlying implementation allows a malicious actor to establish and maintain numerous WebSocket connections without triggering appropriate timeout or disconnection logic after periods of inactivity, thereby exhausting server-side resources such as memory, file descriptors, or thread pools. The core technical flaw lies in the absence of robust validation for connection duration and idle state management within the GraphQL over WebSocket transport layer, which is a common pattern used to maintain real-time communication channels between clients and servers.
From an operational perspective, this vulnerability enables remote attackers to perform resource exhaustion attacks by opening multiple concurrent connections that are kept alive indefinitely or for extended periods without sending meaningful data payloads beyond the initial handshake and periodic keep-alive pings. This behavior leads to a gradual degradation of server performance as system resources are consumed by these dormant but active sessions. Eventually, this can result in complete service unavailability for legitimate users who require access to the GraphQL API endpoints. The impact is particularly severe in environments where WebSocket connections are not strictly rate-limited or monitored for abnormal connection counts per source IP address. Attackers can leverage automated tools to flood the target server with thousands of such keep-alive enabled sessions, effectively creating a distributed denial of service condition without needing to send large volumes of data traffic, thus bypassing traditional bandwidth-based mitigation strategies that focus on volumetric attacks rather than state exhaustion.
This vulnerability aligns closely with CWE-400, which describes Uncontrolled Resource Consumption, as the application fails to limit the amount of resources a single user or connection can consume over time. Furthermore, it maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under subcategories related to resource exhaustion via persistent connections. The lack of proper session timeout enforcement and idle connection management constitutes a failure in implementing adequate security controls for stateful protocols like WebSocket within the GraphQL framework. Developers relying on these versions must recognize that enabling keep-alive features without corresponding safeguards against connection flooding introduces a critical availability risk that undermines the reliability of real-time data delivery mechanisms.
To mitigate this vulnerability, organizations should immediately upgrade to patched versions of Spring for GraphQL where the issue has been resolved through improved handling of WebSocket lifecycle events and stricter enforcement of idle timeout policies. For environments unable to patch immediately due to dependency constraints or legacy system requirements, implementing network-level controls such as rate limiting on new WebSocket connections per source IP address is essential. Additionally, configuring application firewalls or reverse proxies to terminate WebSocket sessions after a defined period of inactivity can help prevent the accumulation of stale keep-alive connections. Monitoring tools should be deployed to track active connection counts and alert administrators when thresholds indicative of potential abuse are exceeded, allowing for rapid intervention before resource exhaustion leads to service disruption. Ensuring that GraphQL servers enforce strict limits on concurrent connections per client identity is a critical step in hardening against this class of denial-of-service attacks.