Advisories · Technology
Spring AI.
Every CVE that names Spring AI among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure
- Spring AI
- Other injection
- CVSS 5.9 Medium
Arbitrary File Write via Path Traversal in ResourceCacheService
- Spring AI
- Path traversal
- CVSS 7.5 High
Predictable cache directory location allows local ONNX model substitution in Spring AI
- Spring AI
- CWE-377
- CVSS 7.5 High
Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
- Spring AI
- Denial of service
- CVSS 6.5 Medium
DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection
- Spring AI
- Broken access control
- CVSS 4.2 Medium
Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation
- Spring AI
- Information disclosure
- CVSS 7.5 High
Unbounded persistent session allocation via repeated initialize requests
- Spring AI
- Denial of service