Spring Spring AI vulnerabilities

Newest CVEs

• CVE-2026-59319

  RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure

  Spring · Spring AI

  Medium4.3
• CVE-2026-59294

  Arbitrary File Write via Path Traversal in ResourceCacheService

  Spring · Spring AI

  Medium5.9
• CVE-2026-47852

  Predictable cache directory location allows local ONNX model substitution in Spring AI

  Spring · Spring AI

  High7.5
• CVE-2026-47851

  Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

  Spring · Spring AI

  High7.5
• CVE-2026-59318

  DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

  Spring · Spring AI

  Medium6.5
• CVE-2026-59308

  Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation

  Spring · Spring AI

  Medium4.2
• CVE-2026-59279

  Unbounded persistent session allocation via repeated initialize requests

  Spring · Spring AI

  High7.5
• CVE-2026-47835

  Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

  Spring · Spring AI

  High8.6
• CVE-2026-41863

  LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API

  Spring · Spring AI

  Medium6.5
• CVE-2026-41705

  Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x:…

  Spring · Spring AI

  High8.6