This Week in Spring - June 23rd, 2026

Hi Spring fans! In this installment, we look at the wide and wonderful world of Spring, as usual, and there's a good amount to get to, fresh off the recent Spring Boot 4.1 generation release train, so let's dive right into it! I wrote a blog post looking at Spring Batch, MongoDB, and Spring Boot...

org.springframework.ai:spring-ai-starter-vector-store-aws-opensearch (>=1.0.0, <=1.0.8), org.springframework.ai:spring-ai-starter-vector-store-opensearch (>=1.0.0, <=1.0.8) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-opensearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-opensearch-store MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.0.0, <=1.0.8) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-aws-opensearch (>=1.1.0, <=1.1.7), org.springframework.ai:spring-ai-starter-vector-store-opensearch (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-opensearch-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-opensearch-store MAVEN version =1.1.0, =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

GHSA-CMWH-W62W-R2MF Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.0.0, <=1.0.8) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core (1.0.0.4) +2 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-aws-opensearch (>=1.0.0, <=1.0.8), org.springframework.ai:spring-ai-starter-vector-store-opensearch (>=1.0.0, <=1.0.8) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-opensearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-opensearch-store MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core (1.0.0.4) +2 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-rag-elasticsearch (>=1.1.0.0-rc1, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-rag (>=1.1.0.0-rc1, <=1.1.2.4-security-fix) +6 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.1.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-aws-opensearch (>=1.1.0, <=1.1.7), org.springframework.ai:spring-ai-starter-vector-store-opensearch (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-opensearch-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-opensearch-store MAVEN version =1.1.0, =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-rag-elasticsearch (>=1.1.0.0-rc1, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-rag (>=1.1.0.0-rc1, <=1.1.2.4-security-fix) +6 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.1.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

CVE-2026-47835

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

org.springframework.ai:spring-ai-starter-vector-store-aws-opensearch (>=1.0.0, <=1.0.8), org.springframework.ai:spring-ai-starter-vector-store-opensearch (>=1.0.0, <=1.0.8) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-opensearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-opensearch-store MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core (1.0.0.4) +2 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

ai.driftkit:driftkit-vector-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-vector-spring-ai-starter (>=0.6.0, <=0.9.2) +195 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-vector-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-vector-store MAVEN version =1.0.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.29 - com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long 1.0.0.4 -...