VMware Spring Ai vulnerabilities

23 CVEs affecting VMware Spring Ai, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59319, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-22738, published 2026-03-27. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary…
CVE-2026-59279, published 2026-08-21. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a…
CVE-2026-22729, published 2026-03-18. High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days. A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions.…
CVE-2026-22730, published 2026-03-18. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability…
CVE-2026-47851, published 2026-08-27. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9
CVE-2026-40978, published 2026-04-28. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in…
CVE-2026-47835, published 2026-06-15. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components:…
CVE-2026-40980, published 2026-04-28. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`. Affected versions: Spring AI: 1.0.0 -…
CVE-2026-41712, published 2026-05-12. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
CVE-2026-41863, published 2026-05-25. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the…

Latest

CVE-2026-59319, published 2026-08-27. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and…
CVE-2026-59294, published 2026-08-27. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new…
CVE-2026-47852, published 2026-08-27. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9
CVE-2026-59318, published 2026-08-21. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that…
CVE-2026-59308, published 2026-08-21. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected…
CVE-2026-41713, published 2026-05-12. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input…