CVE-2026-59308
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI 2.0.0.
Risk Assessment
The risk is that responses intended for one context may be shared with other contexts, potentially leading to information disclosure or incorrect responses.
Recommendation
It is recommended to update Spring AI to a patched version and review the semantic cache configuration.
Other vulnerabilities in Spring AI
See all- CVE-2026-59319Medium
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Affects Spring AI 2.0.0.
- CVE-2026-59294Medium
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.9 and earlier.
- CVE-2026-47852High
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9.
- CVE-2026-47851High
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9.
- CVE-2026-59318Medium
Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9 have a vulnerability in tool calling support where the per-request tool list is not fully enforced. Under certain conditions, a tool not made available to the current request could be invoked, potentially leading to privilege escalation.
- CVE-2026-59279High
The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not limit the number of sessions it retains and by default does not require client authentication. A remote attacker can cause unbounded session accumulation, gradually exhausting memory and leading to Denial of Service (DoS) for all legitimate clients. Affects Spring AI version 2.0.0.
- CVE-2026-41863Medium
In Spring AI versions 1.1.0 through 1.1.x, support for Anthropic's Skills API uses LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.
- CVE-2026-41705High
Vulnerability in Spring AI's MilvusVectorStore#doDelete(List) implementation allows filter-expression injection via unsanitized document IDs. Affects Spring AI 1.0.x (up to 1.0.7) and 1.1.x (up to 1.1.6).
Original NVD description (English source)
In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0