Skip to content
fr Sign in
8.6 High

CVE-2026-47835 In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in…

Description

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).

Affected products and versions

Product Affected versions Fixed in
Spring AI 1.1 1.1.0 → < 1.1.8 1.1.8
Spring AI 1.0 1.0.0 → < 1.0.9 1.0.9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring AI

The 18 CVEs of Spring AI →
CVE-2026-59319 RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values… 4.3 Medium CVE-2026-59294 ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without… 5.9 Medium CVE-2026-47852 A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file 7.5 High CVE-2026-47851 Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread 7.5 High
Track this CVE