Vmware Spring for GraphQL up to 1.3.8/1.4.5/2.0.3 deserialization

Summaryinfo

A vulnerability classified as problematic was found in Vmware Spring for GraphQL up to 1.3.8/1.4.5/2.0.3. This affects an unknown function. The manipulation results in deserialization. This vulnerability is identified as CVE-2026-41699. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Vmware Spring for GraphQL up to 1.3.8/1.4.5/2.0.3. It has been classified as problematic. Affected is an unknown function. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.

The advisory is shared for download at spring.io. This vulnerability is traded as CVE-2026-41699 since 04/22/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/11/2026).

Upgrading to version 1.3.9, 1.4.6 or 2.0.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36212). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Vmware

Name

• Spring for GraphQL

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion