EUVD-2026-16539

Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4j-store, doKey embeds the key into a backtick-delimited...

Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery SSRF vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests...

EUVD-2026-16537

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery SSRF vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests...

GHSA-MHRG-94VW-45C5 Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery SSRF vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests...

EUVD-2026-16541

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue inserts the value directly into the @field:VALUE RediSearch TAG block without escaping characters.This issue affects Spring AI: from 1.0.0 before 1.0....

cn.echoparrot:echoparrot-application (25.4.0), cn.echoparrot:echoparrot-core (>=25.4.0, <=25.4.4) +2 more potentially affected by CVE-2026-22743 via org.springframework.ai:spring-ai-neo4j-store (>=1.1.0-m1, <=1.1.3)

org.springframework.ai:spring-ai-neo4j-store MAVEN version =1.1.0-m1, =25.4.0, =1.1.0-m1, =1.1.3 - org.vrspace:server 0.8.7 Source cves: CVE-2026-22743 Source advisory: GHSA-7CJ7-RCW6-P68V...

com.embabel.agent:embabel-agent-bedrock-autoconfigure (>=0.3.0, <=0.3.4), com.embabel.agent:embabel-agent-starter-bedrock (>=0.3.0, <=0.3.4) +6 more potentially affected by CVE-2026-22742 via org.springframework.ai:spring-ai-bedrock-converse (>=1.1.0-m1, <=1.1.3)

org.springframework.ai:spring-ai-bedrock-converse MAVEN version =1.1.0-m1, =0.3.0, =0.3.0, =3.4.0, =0.2.0, =.30.0.rc1, =.30.0.rc1, =.30.0.rc5, =1.1.0-m1, =1.1.3 Source cves: CVE-2026-22742 Source advisory: GHSA-MHRG-94VW-45C5...

ai.driftkit:driftkit-vector-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-vector-spring-ai-starter (>=0.6.0, <=0.9.2) +195 more potentially affected by CVE-2026-22738 via org.springframework.ai:spring-ai-vector-store (>=1.0.0, <=1.0.4)

org.springframework.ai:spring-ai-vector-store MAVEN version =1.0.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.0, =1.0.0, =1.0.28 - com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long 1.0.0.4 -...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +205 more potentially affected by CVE-2026-22738 via org.springframework.ai:spring-ai-vector-store (>=1.1.0-m1, <=1.1.3)

org.springframework.ai:spring-ai-vector-store MAVEN version =1.1.0-m1, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =25.4.0, =1.21.2, =0.1.0, =0.3.0, =1.1.0.0-m4, =1.1.0.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =1.1.2.4-security-fix and more Source cves: CVE-2026-22738 Source advisory:...

GHSA-FVH3-672C-7P6C Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression...

EUVD-2026-16535

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +205 more potentially affected by CVE-2026-22738 via org.springframework.ai:spring-ai-vector-store (>=1.1.0-m1, <=1.1.3)

org.springframework.ai:spring-ai-vector-store MAVEN version =1.1.0-m1, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =25.4.0, =1.21.2, =0.1.0, =0.3.0, =1.1.0.0-m4, =1.1.0.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =1.1.2.4-security-fix and more Source cves: CVE-2026-22738 Source advisory:...

ai.driftkit:driftkit-vector-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-vector-spring-ai-starter (>=0.6.0, <=0.9.2) +198 more potentially affected by CVE-2026-22738 via org.springframework.ai:spring-ai-vector-store (>=1.0.0-m7, <=1.0.4)

org.springframework.ai:spring-ai-vector-store MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.0, =1.0.0, =1.0.28 - com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long 1.0.0.4 -...

CVE-2026-22744

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue inserts the value directly into the @field:VALUE RediSearch TAG block without escaping characters.This issue affects Spring AI: from 1.0.0 before 1.0....

CVE-2026-22738

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression...

CVE-2026-22742

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery SSRF vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests...

CVE-2026-22743

Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4j-store, doKey embeds the key into a backtick-delimited...

CVE-2026-22744

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue inserts the value directly into the @field:VALUE RediSearch TAG block without escaping characters.This issue affects Spring AI: from 1.0.0 before 1.0....

org.springframework.ai:spring-ai-starter-vector-store-redis (>=1.1.0-m1, <=1.1.3) potentially affected by CVE-2026-22744 via org.springframework.ai:spring-ai-redis-store (>=1.1.0-m1, <=1.1.3)

org.springframework.ai:spring-ai-redis-store MAVEN version =1.1.0-m1, =1.1.0-m1, =1.1.3 Source cves: CVE-2026-22744 Source advisory: MEND:CVE-2026-22744...

com.chinagoods.framework.thinkcloud:think-cloud-starter-ai-vector-redis (>=4.2.3, <=4.2.6), org.springframework.ai:spring-ai-redis-store-spring-boot-starter (>=1.0.0-m5, <=1.0.0-m6) +2 more potentially affected by CVE-2026-22744 via org.springframework.ai:spring-ai-redis-store (>=1.0.0-m5, <=1.0.4)

org.springframework.ai:spring-ai-redis-store MAVEN version =1.0.0-m5, =4.2.3, =1.0.0-m5, =1.0.0-m7, =1.3.0, =1.3.8 Source cves: CVE-2026-22744 Source advisory: MEND:CVE-2026-22744...