biz.eyebeam.mssc:mssc-public-bom (>=1.0.8, <=1.0.12), cn.fscode.common:common-log-spring-boot-starter (0.0.1) +426 more potentially affected by CVE-2026-41708 via org.springframework.cloud:spring-cloud-sleuth-instrumentation (>=3.1.0, <=3.1.11)

org.springframework.cloud:spring-cloud-sleuth-instrumentation MAVEN version =3.1.0, =1.0.8, =0.0.2, =0.0.2, =1.1.0, =4.5.3, =4.5.3, =4.5.3, =4.5.3, =4.5.3, =4.5.3, =4.6.8 and more Source cves: CVE-2026-41708 Source advisory: GHSA-26M2-9G2Q-V45Q...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.0.0, <=1.0.8) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.0.0, <=1.0.8) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

Security Bulletin: MongoDB Enterprised Advanced affected by: Observable Timing Discrepancy (CVE-2026-22746)

Summary There are vulnerabilities in spring-security-core-6.5.9.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-22746. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-22746 DESCRIPTION: Vulnerability in Spring Spring Security. If an application is...

Security Bulletin: MongoDB Enterprised Advanced affected by: Use of Cache Containing Sensitive Information (CVE-2026-22741)

Summary There are vulnerabilities in spring-webmvc-6.2.17.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-22741. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache...

CVE-2026-47835

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

CVE-2026-41708

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is...

CVE-2026-47825

The CVE affects Spring Cloud Gateway Server components (WebMVC and WebFlux gateways) where headers from untrusted proxies (X-Forwarded-For, Forwarded) are forwarded in certain configurations. Root cause: forwarded-header handling without a trusted-proxy basis allows forged headers to reach downst...

CVE-2026-47825 Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x fix 3.1.13. Spring Cloud Gateway 4.1.x fix 4.1.13. Spri...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-boot-3.5.13.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-40973, CVE-2026-40975, CVE-2026-40977. Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...

CVE-2026-41708 Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is...

CVE-2026-41708 Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is...

CVE-2026-41708

The CVE describes a DoS vulnerability in Spring Cloud Sleuth via the Spring TX instrumentation when using vulnerable versions of org.springframework.cloud:spring-cloud-sleuth-instrumentation (SLEUTH 3.1.0–3.1.13). The root cause is exposure of the transaction instrumentation to crafted calls, all...

CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-rag-elasticsearch (>=1.1.0.0-rc1, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-rag (>=1.1.0.0-rc1, <=1.1.2.4-security-fix) +6 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.1.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

org.springframework.ai:spring-ai-starter-vector-store-aws-opensearch (>=1.1.0, <=1.1.7), org.springframework.ai:spring-ai-starter-vector-store-opensearch (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-opensearch-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-opensearch-store MAVEN version =1.1.0, =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

org.springframework.ai:spring-ai-starter-vector-store-aws-opensearch (>=1.0.0, <=1.0.8), org.springframework.ai:spring-ai-starter-vector-store-opensearch (>=1.0.0, <=1.0.8) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-opensearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-opensearch-store MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

ai.koog:koog-spring-ai-starter-vector-store (>=0.8.0-rc-1, <=1.3.0-beta), ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6) +306 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-vector-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-vector-store MAVEN version =1.1.0, =0.8.0-rc-1, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =25.4.0, =1.21.2, =0.1.0, =0.3.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.2.4-security-fix and more Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...