CVE-2026-22742

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery SSRF vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests...

com.embabel.agent:embabel-agent-bedrock-autoconfigure (0.2.0), com.embabel.agent:embabel-agent-starter-bedrock (0.2.0) +2 more potentially affected by CVE-2026-22742 via org.springframework.ai:spring-ai-bedrock-converse (>=1.0.0-m5, <=1.0.4)

org.springframework.ai:spring-ai-bedrock-converse MAVEN version =1.0.0-m5, =1.0.0-m5, =1.0.0-m7, =1.0.4 Source cves: CVE-2026-22742 Source advisory: OSV:GHSA-MHRG-94VW-45C5...

CVE-2026-22742

creationtimestamp| type| source ---|---|--- 2026-03-26 20:05:49+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-288 2026-03-27 07:00:49+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhzkbsrncs2v 2026-03-27 07:18:31+00:00| seen|...