8.6
Élevée
CVE-2026-47835 In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in…
Description
In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).
Produits et versions touchés
Autres CVE de Spring AI
Les 18 CVE de Spring AI →
CVE-2026-59319
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values…
4.3
Moyenne
CVE-2026-59294
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without…
5.9
Moyenne
CVE-2026-47852
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file
7.5
Élevée
CVE-2026-47851
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread
7.5
Élevée