Spring Spring Ai
18 CVEs affecting Spring Spring Ai. Latest disclosed: 2026-08-27. Critical: 1, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22738 | Critical | 9.8 | 2026-03-27 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could… |
CVE-2026-40978 | High | 8.8 | 2026-04-28 | SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions… |
CVE-2026-47835 | High | 8.6 | 2026-06-15 | In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Af… |
CVE-2026-41705 | High | 8.6 | 2026-05-09 | Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affecte… |
CVE-2026-40967 | High | 8.6 | 2026-04-28 | In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages… |
CVE-2026-22742 | High | 8.6 | 2026-03-27 | Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages… |
CVE-2026-47852 | High | 7.5 | 2026-08-27 | A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1… |
CVE-2026-47851 | High | 7.5 | 2026-08-27 | Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1… |
CVE-2026-59279 | High | 7.5 | 2026-08-21 | The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not r… |
CVE-2026-22744 | High | 7.5 | 2026-03-27 | In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts th… |
CVE-2026-22743 | High | 7.5 | 2026-03-27 | Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as… |
CVE-2026-59318 | Medium | 6.5 | 2026-08-21 | In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatche… |
CVE-2026-41863 | Medium | 6.5 | 2026-05-25 | Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malic… |
CVE-2026-40980 | Medium | 6.5 | 2026-04-28 | In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`. … |
CVE-2026-40979 | Medium | 6.1 | 2026-04-28 | In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1… |
CVE-2026-59294 | Medium | 5.9 | 2026-08-27 | ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and… |
CVE-2026-59319 | Medium | 4.3 | 2026-08-27 | RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape()… |
CVE-2026-59308 | Medium | 4.2 | 2026-08-21 | In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be sh… |