ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +104 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-openai (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-openai MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =1.21.2, =1.1.0.0-rc1, =1.1.0.0-m4, =1.1.2.4-security-fix and more Source cves: CVE-2026-41712 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16624639...

SQL Injection

org.springframework.ai, spring-ai-azure-cosmos-db-store is vulnerable to SQL Injection. The vulnerability is due to improper handling of crafted document IDs in the CosmosDBVectorStore, which allows an attacker to execute arbitrary SQL queries...

This Week in Spring - May 5th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's May 5th, 2026, and I'm in Mainz, Germany, for the legendary JAX conference! It's been infinitely far too long since I've been at this amazing show, and I'm oh-so happy to be back here! Tonight, after my two talks here, I...

Spring AI 1.0.x < 1.0.6 / 1.1.x < 1.1.5 Multiple Vulnerabilities

The version of Spring AI installed on the remote host is 1.0.x prior to 1.0.6 or 1.1.x prior to 1.1.5. It is, therefore, affected by multiple vulnerabilities, including: - A SQL injection vulnerability in CosmosDBVectorStore allows attackers to execute arbitrary SQL queries via crafted document...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1743 more potentially affected by CVE-2026-22740 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-22740 Source advisory: GHSA-5843-P793-GHMM...

CVE-2026-40967

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected versions: Spring AI: 1.0.0...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.1.0, <=1.1.4) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.1.0, <=1.1.4)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.1.0, =1.1.0, =1.1.4 Source cves: CVE-2026-40978 Source advisory: OSV:GHSA-63C8-M9M2-CVR3...

com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (1.0.0.4) +3 more potentially affected by CVE-2026-40966 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.0.0, =1.0.0.1, =1.0.0.3-20260305-cve - com.alibaba.cloud.ai:spring-ai-alibaba-studio-client 1.0.0.4 Source cves: CVE-2026-40966 Source advisory: GHSA-V6X6-PJXW-3PV2...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-memory-long (>=1.1.0.0-rc1, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (>=1.1.0.0-rc1, <=1.1.2.4-security-fix) +8 more potentially affected by CVE-2026-40966 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.1.0, <=1.1.4)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.1.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0.0-rc1, =0.0.6, =4.17.0, =4.17.0, =4.20.0 - org.vrspace:server 0.8.7 Source cves: CVE-2026-40966 Source advisory: OSV:GHSA-V6X6-PJXW-3PV2...

Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input a...

com.redis.om:redis-om-spring-ai (>=1.0.0-rc2, <=2.0.10), io.github.massimilianopili:mcp-embeddings-tools (>=0.0.1, <=0.1.0) +2 more potentially affected by CVE-2026-40979 via org.springframework.ai:spring-ai-transformers (>=1.0.0, <=1.0.5)

org.springframework.ai:spring-ai-transformers MAVEN version =1.0.0, =1.0.0-rc2, =0.0.1, =1.0.0, =1.0.5 Source cves: CVE-2026-40979 Source advisory: GHSA-R5HP-3CGJ-J6XV...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-memory-long (>=1.1.0.0-rc1, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (>=1.1.0.0-rc1, <=1.1.2.4-security-fix) +8 more potentially affected by CVE-2026-40966 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.1.0, <=1.1.4)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.1.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0.0-rc1, =0.0.6, =4.17.0, =4.17.0, =4.20.0 - org.vrspace:server 0.8.7 Source cves: CVE-2026-40966 Source advisory: GHSA-V6X6-PJXW-3PV2...

GHSA-V6X6-PJXW-3PV2 Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input a...

com.alibaba.cloud.ai:spring-ai-alibaba-starter-document-parser-apache-pdfbox (>=1.0.0.1, <=1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-document-parser-bibtex (>=1.0.0.1, <=1.0.0.4) +6 more potentially affected by CVE-2026-40980 via org.springframework.ai:spring-ai-pdf-document-reader (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-pdf-document-reader MAVEN version =1.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.4 - com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin 1.0.0.4 - com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core 1.0.0.4 -...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.0.0, <=1.0.5) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.0.0, <=1.0.5)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.0.0, =1.0.0, =1.0.5 Source cves: CVE-2026-40978 Source advisory: GHSA-63C8-M9M2-CVR3...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.1.0, <=1.1.4) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.1.0, <=1.1.4)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.1.0, =1.1.0, =1.1.4 Source cves: CVE-2026-40978 Source advisory: GHSA-63C8-M9M2-CVR3...

GHSA-R5HP-3CGJ-J6XV Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...

com.thecookiezen:archiledger-core (>=0.0.4, <=0.0.5), io.github.massimilianopili:mcp-vector-tools (0.3.1) +1 more potentially affected by CVE-2026-40979 via org.springframework.ai:spring-ai-transformers (>=1.1.0, <=1.1.4)

org.springframework.ai:spring-ai-transformers MAVEN version =1.1.0, =0.0.4, =1.1.0, =1.1.4 Source cves: CVE-2026-40979 Source advisory: GHSA-R5HP-3CGJ-J6XV...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.0.0, <=1.0.5) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.0.0, <=1.0.5)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.0.0, =1.0.0, =1.0.5 Source cves: CVE-2026-40978 Source advisory: OSV:GHSA-63C8-M9M2-CVR3...

Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...