8.6
Élevée
CVE-2026-40967 In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them…
Description
In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Produits et versions touchés
Autres CVE de Spring AI
Les 18 CVE de Spring AI →
CVE-2026-59319
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values…
4.3
Moyenne
CVE-2026-59294
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without…
5.9
Moyenne
CVE-2026-47852
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file
7.5
Élevée
CVE-2026-47851
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread
7.5
Élevée