CVE-2026-59287

Overview

Spring for GraphQL is the Spring team's GraphQL integration, built on GraphQL Java, that lets applications expose a GraphQL API over Spring MVC or Spring WebFlux with HTTP, WebSocket, RSocket and Server-Sent Events transports. Alongside the server side it ships a client side, including WebSocketGraphQlClient, which executes queries, mutations and subscriptions against a remote GraphQL API over a persistent WebSocket connection.

A Denial of Service (DoS) vulnerability (CVE-2026-59287) has been identified in the WebSocket client transport of Spring for GraphQL, which allows attackers to exhaust application memory by forcing repeated reconnects that each leave a live keepAlive subscription behind.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects the WebSocket client of Spring for GraphQL, and only when an application uses WebSocketGraphQlClient with the keepAlive option configured and an attacker controls the GraphQL server or can interfere with the WebSocket connection. Server-side components are not affected.

‍

Details

Module Info

• Product: Spring for GraphQL
• Affected packages: org.springframework.graphql:spring-graphql
• Affected versions: >=1.3.0 <=1.3.9, >=1.4.0 <=1.4.6, >=2.0.0 <=2.0.4
• GitHub repository: https://github.com/spring-projects/spring-graphql
• Published packages: https://central.sonatype.com/artifact/org.springframework.graphql/spring-graphql
• Package manager: Maven
• Fixed in:
• NES for Spring for GraphQL: nes-v1.3.12 and nes-v1.4.8
• OSS Spring for GraphQL 2.0.5

Vulnerability Info

This Medium-severity vulnerability is found in the org.springframework.graphql:spring-graphql package in the WebSocket client transport of Spring for GraphQL.

When a WebSocket session is established, the session handler in WebSocketGraphQlTransport registered the configured keepAlive interval twice. The first registration merges an interval into the session's receive pipeline, so it is tied to the session lifecycle and terminates with it. The second registration then starts an independent interval with a bare subscribe call:

Mono<Void> receiveCompletion = session.receive()
        .flatMap((webSocketMessage) -> {
            // decode and dispatch the incoming GraphQL message
            return Mono.empty();
        })
        .mergeWith((this.keepAlive != null) ?
                Flux.interval(this.keepAlive, this.keepAlive)
                        .filter((aLong) -> graphQlSession.checkSentOrReceivedMessagesAndClear())
                        .doOnNext((aLong) -> graphQlSession.sendPing())
                        .then() :
                Flux.empty())
        .then();

if (this.keepAlive != null) {
    Flux.interval(this.keepAlive, this.keepAlive)
            .filter((aLong) -> graphQlSession.checkSentOrReceivedMessagesAndClear())
            .doOnNext((aLong) -> graphQlSession.sendPing())
            .subscribe();
}

return Mono.zip(sendCompletion, receiveCompletion.then()).then();

The subscription returned by that second subscribe() call is never captured and never disposed, so nothing cancels it when the WebSocket session closes. Each session therefore leaks a timer subscription that keeps referencing the closed session and its handler for the lifetime of the application.

The input that reaches this path is the remote peer's control of the connection. A malicious or man-in-the-middled GraphQL server can close the WebSocket repeatedly; the client transport reconnects and establishes a new session each time, and every reconnect adds another live interval subscription to the scheduler while the previous ones remain. Because the attacker controls how often that cycle repeats, the accumulation is unbounded, and memory and scheduler work grow until the application degrades or fails, which is an availability impact reachable over the network with no privileges or user interaction.

This vulnerability was introduced in 2024 with Spring for GraphQL 1.3.0.

‍

Mitigation

Only recent versions of Spring for GraphQL receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring for GraphQL.
• If upgrading is not immediately possible, remove the keepAlive configuration from WebSocketGraphQlClient, which disables the affected code path, and connect only to trusted GraphQL endpoints over TLS.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• No finder is named in the vendor advisory for this issue.