com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (1.0.0.4) +3 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.0.0, =1.0.0.1, =1.0.0.3-20260305-cve - com.alibaba.cloud.ai:spring-ai-alibaba-studio-client 1.0.0.4 Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0 (2.0.0-m1.1), com.alibaba.cloud.ai:spring-ai-alibaba-model-chat-memory-repository-mem0 (2.0.0-m1.1) +2 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=2.0.0-m1, <=2.0.0-m4)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =2.0.0-m1, =0.1.0, =0.1.1 Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

ai.driftkit:driftkit-clients-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +492 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.0.0-m7, <=1.0.6)

org.springframework.ai:spring-ai-model MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28 - ai.intelliswarm:swarmai-rag 1.0.28 and more Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +354 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-client-chat (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.4 and more Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-memory-long (>=1.1.0.0-m3, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (>=1.1.0.0-m3, <=1.1.2.4-security-fix) +11 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.1.0-m3, <=1.1.5)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.1.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =0.0.6, =1.1.19, =1.1.19, =1.1.19, =4.17.0, =4.17.0, =4.20.0 - org.vrspace:server 0.8.7 Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (1.0.0.4) +3 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.0.0, =1.0.0.1, =1.0.0.3-20260305-cve - com.alibaba.cloud.ai:spring-ai-alibaba-studio-client 1.0.0.4 Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

ai.driftkit:driftkit-clients-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +492 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.0.0-m7, <=1.0.6)

org.springframework.ai:spring-ai-model MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28 - ai.intelliswarm:swarmai-rag 1.0.28 and more Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-G...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0 (2.0.0-m1.1), com.alibaba.cloud.ai:spring-ai-alibaba-model-chat-memory-repository-mem0 (2.0.0-m1.1) +2 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=2.0.0-m1, <=2.0.0-m4)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =2.0.0-m1, =0.1.0, =0.1.1 Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +354 more potentially affected by CVE-2026-41713 via org.springframework.ai:spring-ai-client-chat (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.4 and more Source cves: CVE-2026-41713 Source advisory: GHSA-5852-PHMH-8FHR...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +354 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-client-chat (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.4 and more Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-memory-long (>=1.1.0.0-m3, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (>=1.1.0.0-m3, <=1.1.2.4-security-fix) +11 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.1.0-m3, <=1.1.5)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.1.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =0.0.6, =1.1.19, =1.1.19, =1.1.19, =4.17.0, =4.17.0, =4.20.0 - org.vrspace:server 0.8.7 Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

GHSA-Q62F-H9X2-GCQC Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +133 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-client-chat (>=2.0.0-m1, <=2.0.0-m5)

org.springframework.ai:spring-ai-client-chat MAVEN version =2.0.0-m1, =0.1.0, =0.1.0, =1.22.3, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +632 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-model MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.6 and more Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

ai.driftkit:driftkit-clients-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +344 more potentially affected by CVE-2026-41713 via org.springframework.ai:spring-ai-client-chat (>=1.0.0-m7, <=1.0.6)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28 - ai.intelliswarm:swarmai-rag 1.0.28 and more Source cves: CVE-2026-41713 Source advisory:...

CVE-2026-41712

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (1.0.0.4) +3 more potentially affected by CVE-2026-41713 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.0.0, =1.0.0.1, =1.0.0.3-20260305-cve - com.alibaba.cloud.ai:spring-ai-alibaba-studio-client 1.0.0.4 Source cves: CVE-2026-41713 Source advisory: MEND:CVE-2026-41713...

CVE-2026-41712

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (1.0.0.4) +3 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.0.0, =1.0.0.1, =1.0.0.3-20260305-cve - com.alibaba.cloud.ai:spring-ai-alibaba-studio-client 1.0.0.4 Source cves: CVE-2026-41712 Source advisory: MEND:CVE-2026-41712...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +632 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-model MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.6 and more Source cves: CVE-2026-41712 Source advisory: MEND:CVE-2026-41712...