org.springframework.graphql:spring-graphql 2.0.1

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.graphql:spring-graphql package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Deserialization of Untrusted Data org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via deserialization of pagination-related data in Spring GraphQL. An attacker can achieve remote code execution by supplying a crafted GraphQL request targeting a paginated (Connection) field, causing the application to deserialize attacker-controlled data into classes on the application's classpath. If suitable gadget classes are present, unintended code execution may occur during object instantiation or deserialization. Note: This is only exploitable if the application uses Spring GraphQL, exposes a paginated (Connection) field, and includes classes on the classpath that can be abused as deserialization gadgets. How to fix Deserialization of Untrusted Data? Upgrade `org.springframework.graphql:spring-graphql` to version 1.4.6, 2.0.4 or higher.	[,1.4.6)[2.0.0-M1,2.0.4)
H Origin Validation Error org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Origin Validation Error via insufficient Origin validation for WebSocket connections. An attacker can perform Cross-Site WebSocket Hijacking (CSWSH) by inducing an authenticated user to visit a malicious website that establishes a WebSocket connection to the vulnerable application. If cookie-based session authentication is used and WebSocket Origin checks are not enforced, the attacker can execute arbitrary GraphQL operations using the victim's authenticated session. Note: This is only exploitable if the application has enabled the GraphQL WebSocket transport, relies on cookie-based session authentication, and does not implement custom Spring Security WebSocket Origin enforcement. How to fix Origin Validation Error? Upgrade `org.springframework.graphql:spring-graphql` to version 1.4.6, 2.0.4 or higher.	[,1.4.6)[2.0.0-M1,2.0.4)
H Incorrect Authorization org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Incorrect Authorization via annotation resolution for `@Controller` data fetchers in Spring GraphQL. An attacker can bypass authorization checks when security annotations defined within a controller type hierarchy are not correctly resolved at runtime. As a result, methods that are expected to be protected by Spring Security method-level authorization may be invoked without the intended access controls. Note: This is only exploitable if the application uses Spring Security with `@EnableMethodSecurity`, implements GraphQL `@Controller` classes within type hierarchies, and relies on security annotations for authorization decisions. How to fix Incorrect Authorization? Upgrade `org.springframework.graphql:spring-graphql` to version 1.4.6, 2.0.4 or higher.	[,1.4.6)[2.0.0-M1,2.0.4)

Vulnerability

Vulnerable Version

Deserialization of Untrusted Data

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via deserialization of pagination-related data in Spring GraphQL. An attacker can achieve remote code execution by supplying a crafted GraphQL request targeting a paginated (Connection) field, causing the application to deserialize attacker-controlled data into classes on the application's classpath. If suitable gadget classes are present, unintended code execution may occur during object instantiation or deserialization.

Note: This is only exploitable if the application uses Spring GraphQL, exposes a paginated (Connection) field, and includes classes on the classpath that can be abused as deserialization gadgets.

How to fix Deserialization of Untrusted Data?

Upgrade org.springframework.graphql:spring-graphql to version 1.4.6, 2.0.4 or higher.

[,1.4.6)[2.0.0-M1,2.0.4)

Origin Validation Error

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Origin Validation Error via insufficient Origin validation for WebSocket connections. An attacker can perform Cross-Site WebSocket Hijacking (CSWSH) by inducing an authenticated user to visit a malicious website that establishes a WebSocket connection to the vulnerable application. If cookie-based session authentication is used and WebSocket Origin checks are not enforced, the attacker can execute arbitrary GraphQL operations using the victim's authenticated session.

Note: This is only exploitable if the application has enabled the GraphQL WebSocket transport, relies on cookie-based session authentication, and does not implement custom Spring Security WebSocket Origin enforcement.

How to fix Origin Validation Error?

Upgrade org.springframework.graphql:spring-graphql to version 1.4.6, 2.0.4 or higher.

[,1.4.6)[2.0.0-M1,2.0.4)

Incorrect Authorization

org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications

Affected versions of this package are vulnerable to Incorrect Authorization via annotation resolution for @Controller data fetchers in Spring GraphQL. An attacker can bypass authorization checks when security annotations defined within a controller type hierarchy are not correctly resolved at runtime. As a result, methods that are expected to be protected by Spring Security method-level authorization may be invoked without the intended access controls.

Note: This is only exploitable if the application uses Spring Security with @EnableMethodSecurity, implements GraphQL @Controller classes within type hierarchies, and relies on security annotations for authorization decisions.

How to fix Incorrect Authorization?

Upgrade org.springframework.graphql:spring-graphql to version 1.4.6, 2.0.4 or higher.

[,1.4.6)[2.0.0-M1,2.0.4)

org.springframework.graphql:spring-graphql@2.0.1

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically