What’s Vulnerable › Vulnerabilities

CVE-2023-34047: Exposure of data and identity to wrong session in Spring for GraphQL

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-20 · updated 2026-06-17

Description

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.

Affected products

• Spring for GraphQL: from 1.1.0 through 1.1.5; from 1.2.0 through 1.2.2
• Spring for GraphQL: from 1.1.0 before 1.1.6; from 1.2.0 before 1.2.3 — fixed in 1.1.6, 1.2.3

How to fix

Upgrade to a fixed version: Spring for GraphQL 1.1.6, 1.2.3. Check the vendor advisory for mitigations.

References

• https://spring.io/security/cve-2023-34047
• https://spring.io/security/cve-2023-34047

Get alerted when CVE-2023-34047 or the next vulnerability affects your stack