org.springframework.graphql:spring-graphql 2.0.0-RC1

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.graphql:spring-graphql package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `WebSocketGraphQlClient` when the keepAlive option is enabled and an attacker is able to interfere with the WebSocket connection. An attacker can exhaust application memory by controlling the GraphQL server or performing a Man-in-the-Middle attack on the WebSocket connection. Note: This is only exploitable if the application uses the `WebSocketGraphQlClient` with keepAlive enabled and the attacker can interfere with the WebSocket connection. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework.graphql:spring-graphql` to version 2.0.5 or higher.	[1.3.0,2.0.5)
H Allocation of Resources Without Limits or Throttling org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pagination support. An attacker can exhaust application memory or place significant, prolonged load on the underlying datastore by forging a malicious query for a Connection field that is backed by a Spring Data repository and exposed through auto-registration support. Note: This is only exploitable if the application exposes a Connection-typed Query field backed by a Spring Data repository through auto-registration support (such as `QueryByExampleDataFetcher` or `QuerydslDataFetcher`) and does not enforce additional query complexity checks. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework.graphql:spring-graphql` to version 2.0.5 or higher.	[1.2.0,2.0.5)
H Cross-site Request Forgery (CSRF) org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the `GraphiQL` process. An attacker can access confidential information by enticing a victim with an active session to follow a malicious link to the `GraphiQL` page, causing the victim's browser to send sensitive data to the attacker's website. Note: This is only exploitable if the `GraphiQL` endpoint is enabled and exposed, and a victim with an active session visits a malicious link. How to fix Cross-site Request Forgery (CSRF)? Upgrade `org.springframework.graphql:spring-graphql` to version 2.0.5 or higher.	[1.0.0,2.0.5)
C Unsafe Dependency Resolution org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the `GraphiQL`. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising the CDN or the network path to it, allowing access to non-HttpOnly cookies and the ability to issue authenticated same-origin requests, including GraphQL operations. Note: This is only exploitable if the `GraphiQL` endpoint is enabled and exposed, and the CDN or its network path is compromised. How to fix Unsafe Dependency Resolution? Upgrade `org.springframework.graphql:spring-graphql` to version 2.0.5 or higher.	[1.0.0,2.0.5)
C Deserialization of Untrusted Data org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via deserialization of pagination-related data in Spring GraphQL. An attacker can achieve remote code execution by supplying a crafted GraphQL request targeting a paginated (Connection) field, causing the application to deserialize attacker-controlled data into classes on the application's classpath. If suitable gadget classes are present, unintended code execution may occur during object instantiation or deserialization. Note: This is only exploitable if the application uses Spring GraphQL, exposes a paginated (Connection) field, and includes classes on the classpath that can be abused as deserialization gadgets. How to fix Deserialization of Untrusted Data? Upgrade `org.springframework.graphql:spring-graphql` to version 1.4.6, 2.0.4 or higher.	[,1.4.6)[2.0.0-M1,2.0.4)
H Origin Validation Error org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Origin Validation Error via insufficient Origin validation for WebSocket connections. An attacker can perform Cross-Site WebSocket Hijacking (CSWSH) by inducing an authenticated user to visit a malicious website that establishes a WebSocket connection to the vulnerable application. If cookie-based session authentication is used and WebSocket Origin checks are not enforced, the attacker can execute arbitrary GraphQL operations using the victim's authenticated session. Note: This is only exploitable if the application has enabled the GraphQL WebSocket transport, relies on cookie-based session authentication, and does not implement custom Spring Security WebSocket Origin enforcement. How to fix Origin Validation Error? Upgrade `org.springframework.graphql:spring-graphql` to version 1.4.6, 2.0.4 or higher.	[,1.4.6)[2.0.0-M1,2.0.4)
H Incorrect Authorization org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Incorrect Authorization via annotation resolution for `@Controller` data fetchers in Spring GraphQL. An attacker can bypass authorization checks when security annotations defined within a controller type hierarchy are not correctly resolved at runtime. As a result, methods that are expected to be protected by Spring Security method-level authorization may be invoked without the intended access controls. Note: This is only exploitable if the application uses Spring Security with `@EnableMethodSecurity`, implements GraphQL `@Controller` classes within type hierarchies, and relies on security annotations for authorization decisions. How to fix Incorrect Authorization? Upgrade `org.springframework.graphql:spring-graphql` to version 1.4.6, 2.0.4 or higher.	[,1.4.6)[2.0.0-M1,2.0.4)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocketGraphQlClient when the keepAlive option is enabled and an attacker is able to interfere with the WebSocket connection. An attacker can exhaust application memory by controlling the GraphQL server or performing a Man-in-the-Middle attack on the WebSocket connection.

Note: This is only exploitable if the application uses the WebSocketGraphQlClient with keepAlive enabled and the attacker can interfere with the WebSocket connection.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework.graphql:spring-graphql to version 2.0.5 or higher.

[1.3.0,2.0.5)

Allocation of Resources Without Limits or Throttling

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pagination support. An attacker can exhaust application memory or place significant, prolonged load on the underlying datastore by forging a malicious query for a Connection field that is backed by a Spring Data repository and exposed through auto-registration support.

Note: This is only exploitable if the application exposes a Connection-typed Query field backed by a Spring Data repository through auto-registration support (such as QueryByExampleDataFetcher or QuerydslDataFetcher) and does not enforce additional query complexity checks.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework.graphql:spring-graphql to version 2.0.5 or higher.

[1.2.0,2.0.5)

Cross-site Request Forgery (CSRF)

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active session to follow a malicious link to the GraphiQL page, causing the victim's browser to send sensitive data to the attacker's website.

Note: This is only exploitable if the GraphiQL endpoint is enabled and exposed, and a victim with an active session visits a malicious link.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade org.springframework.graphql:spring-graphql to version 2.0.5 or higher.

[1.0.0,2.0.5)

Unsafe Dependency Resolution

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the GraphiQL. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising the CDN or the network path to it, allowing access to non-HttpOnly cookies and the ability to issue authenticated same-origin requests, including GraphQL operations.

Note: This is only exploitable if the GraphiQL endpoint is enabled and exposed, and the CDN or its network path is compromised.

How to fix Unsafe Dependency Resolution?

Upgrade org.springframework.graphql:spring-graphql to version 2.0.5 or higher.

[1.0.0,2.0.5)

Deserialization of Untrusted Data

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via deserialization of pagination-related data in Spring GraphQL. An attacker can achieve remote code execution by supplying a crafted GraphQL request targeting a paginated (Connection) field, causing the application to deserialize attacker-controlled data into classes on the application's classpath. If suitable gadget classes are present, unintended code execution may occur during object instantiation or deserialization.

Note: This is only exploitable if the application uses Spring GraphQL, exposes a paginated (Connection) field, and includes classes on the classpath that can be abused as deserialization gadgets.

How to fix Deserialization of Untrusted Data?

Upgrade org.springframework.graphql:spring-graphql to version 1.4.6, 2.0.4 or higher.

[,1.4.6)[2.0.0-M1,2.0.4)

Origin Validation Error

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Origin Validation Error via insufficient Origin validation for WebSocket connections. An attacker can perform Cross-Site WebSocket Hijacking (CSWSH) by inducing an authenticated user to visit a malicious website that establishes a WebSocket connection to the vulnerable application. If cookie-based session authentication is used and WebSocket Origin checks are not enforced, the attacker can execute arbitrary GraphQL operations using the victim's authenticated session.

Note: This is only exploitable if the application has enabled the GraphQL WebSocket transport, relies on cookie-based session authentication, and does not implement custom Spring Security WebSocket Origin enforcement.

How to fix Origin Validation Error?

Upgrade org.springframework.graphql:spring-graphql to version 1.4.6, 2.0.4 or higher.

[,1.4.6)[2.0.0-M1,2.0.4)

Incorrect Authorization

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Incorrect Authorization via annotation resolution for @Controller data fetchers in Spring GraphQL. An attacker can bypass authorization checks when security annotations defined within a controller type hierarchy are not correctly resolved at runtime. As a result, methods that are expected to be protected by Spring Security method-level authorization may be invoked without the intended access controls.

Note: This is only exploitable if the application uses Spring Security with @EnableMethodSecurity, implements GraphQL @Controller classes within type hierarchies, and relies on security annotations for authorization decisions.

How to fix Incorrect Authorization?

Upgrade org.springframework.graphql:spring-graphql to version 1.4.6, 2.0.4 or higher.

[,1.4.6)[2.0.0-M1,2.0.4)

org.springframework.graphql:spring-graphql@2.0.0-RC1

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically