Critical Spring GraphQL Deserialization Flaw Enables Remote Code Execution
Brief
A critical unsafe deserialization vulnerability in Spring for GraphQL, tracked as CVE-2026-59285, could enable remote code execution in affected applications under specific conditions.
The flaw was disclosed in Broadcom’s August 20 security release, which included 91 CVEs affecting Spring Framework and related projects. Sonatype assigned CVE-2026-59285 a CVSS score of 9. 2, placing it in the Critical severity range.
The issue affects applications using Spring for GraphQL with Jackson 2.x for JSON deserialization, paginated GraphQL fields, and certain classes that can be abused during deserialization.
Critical Spring GraphQL Deserialization Flaw
Unsafe deserialization occurs when an application accepts serialized data from an untrusted source and reconstructs it into objects without sufficiently restricting which types may be created.