Aller au contenu
en Se connecter
4.3 Moyenne

CVE-2026-59319 RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values…

Description

RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Spring AI 2.0.0

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring AI 2.0.0 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Spring AI

Les 18 CVE de Spring AI →
CVE-2026-59294 ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without… 5.9 Moyenne CVE-2026-47852 A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file 7.5 Élevée CVE-2026-47851 Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread 7.5 Élevée CVE-2026-59318 In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully… 6.5 Moyenne
Suivre cette CVE