VMware Spring Ai
23 CVEs affecting VMware Spring Ai. Latest disclosed: 2026-08-27. Critical: 1, High: 14.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22738 | Critical | 9.8 | 2026-03-27 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could… |
CVE-2026-40978 | High | 8.8 | 2026-04-28 | SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions… |
CVE-2026-22730 | High | 8.8 | 2026-03-18 | A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute ar… |
CVE-2026-47835 | High | 8.6 | 2026-06-15 | In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Af… |
CVE-2026-41705 | High | 8.6 | 2026-05-09 | Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affecte… |
CVE-2026-40967 | High | 8.6 | 2026-04-28 | In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages… |
CVE-2026-22742 | High | 8.6 | 2026-03-27 | Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages… |
CVE-2026-22729 | High | 8.6 | 2026-03-18 | A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through… |
CVE-2026-41713 | High | 8.2 | 2026-05-12 | A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affect… |
CVE-2026-47852 | High | 7.5 | 2026-08-27 | A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1… |
CVE-2026-47851 | High | 7.5 | 2026-08-27 | Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1… |
CVE-2026-59279 | High | 7.5 | 2026-08-21 | The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not r… |
CVE-2026-41712 | High | 7.5 | 2026-05-12 | Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users. |
CVE-2026-22744 | High | 7.5 | 2026-03-27 | In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts th… |
CVE-2026-22743 | High | 7.5 | 2026-03-27 | Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as… |
CVE-2026-59318 | Medium | 6.5 | 2026-08-21 | In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatche… |
CVE-2026-41863 | Medium | 6.5 | 2026-05-25 | Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malic… |
CVE-2026-40980 | Medium | 6.5 | 2026-04-28 | In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`. … |
CVE-2026-40979 | Medium | 6.1 | 2026-04-28 | In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1… |
CVE-2026-59294 | Medium | 5.9 | 2026-08-27 | ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and… |