Approved changes feed: RSS · Atom
cpe:2.3:a:spring:spring_ai:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Spring (4c7a31af-cbd7-516f-b1ce-2d5f574797bc) |
|---|---|
| Product | Spring Ai (80077f5f-bcd8-5d1f-bdca-570ed1e7af62) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-47835 |
vulnerable | 2026-07-29 00:55:00.442465 |
Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
HIGH (8.6)
In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store.
Affected versions:
Spring AI 1.0.0 through 1.0.x (fix 1.0.9).
Spring AI 1.1.0 through 1.1.x (fix 1.1.8).
Published: 2026-06-15T18:54:19.841Z
Updated: 2026-06-15T20:06:56.646Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41863 |
vulnerable | 2026-06-08 08:03:15.714600 |
LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API
MEDIUM (6.5)
Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.
Affected versions:
Spring AI: 1.1.0 through 1.1.x
Published: 2026-05-25T05:45:37.690Z
Updated: 2026-05-26T14:19:10.481Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41705 |
vulnerable | 2026-06-08 08:03:15.709468 |
Details available
HIGH (8.6)
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.
Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 or greater.
Published: 2026-05-09T00:34:17.870Z
Updated: 2026-05-11T14:38:29.738Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40980 |
vulnerable | 2026-06-08 08:03:14.526532 |
Details available
MEDIUM (6.5)
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`.
Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Published: 2026-04-28T07:31:24.041Z
Updated: 2026-04-28T12:32:40.140Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40979 |
vulnerable | 2026-06-08 08:03:14.526134 |
Details available
MEDIUM (6.1)
In Spring AI, having access to a shared environment can expose the ONNX model used by the application.
Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Published: 2026-04-28T07:31:21.447Z
Updated: 2026-04-28T12:33:07.977Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40978 |
vulnerable | 2026-06-08 08:03:14.525561 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40967 |
vulnerable | 2026-06-08 08:03:14.510367 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22744 |
vulnerable | 2026-06-08 07:51:13.748930 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22743 |
vulnerable | 2026-06-08 07:51:13.748586 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22742 |
vulnerable | 2026-06-08 07:51:13.748164 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22738 |
vulnerable | 2026-06-08 07:51:13.745198 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.