What is CVE-2026-59308?

CVE-2026-59308 is a medium-severity vulnerability in Spring Ai, classified under Exposure of Resource to Wrong Sphere. CVSS score: 4.2/10. Published 2026-08-21.

How severe is CVE-2026-59308?

Medium severity. CVSS v3 base score is 4.2 out of 10.

Vulnerability in Spring Ai

CVE-2026-59308

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0

CVSS v3 metric

CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Spring Ai — versions 2.0.0

Weakness classification (CWE)

CWE-668 — Exposure of Resource to Wrong Sphere

References

security@vmware.com

Frequently asked questions

What is CVE-2026-59308?: CVE-2026-59308 is a medium-severity vulnerability in Spring Ai, classified under Exposure of Resource to Wrong Sphere. CVSS score: 4.2/10. Published 2026-08-21.
How severe is CVE-2026-59308?: Medium severity. CVSS v3 base score is 4.2 out of 10.