SB20260828172 - Multiple vulnerabilities in Spring AI
Published: August 28, 2026 Updated: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Insecure Temporary File (CVE-ID: CVE-2026-47852)
CWE-ID: CWE-377 - Insecure Temporary File
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to tamper with model integrity.
The vulnerability exists due to improper access control in the ONNX model cache directory handling when resolving the deterministic cache path. A remote attacker can pre-create the cache path and plant a malicious ONNX model file to tamper with model integrity.
This issue is exploitable on a multi-user host.
2) Uncontrolled Recursion (CVE-ID: CVE-2026-47851)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to unbounded recursion in the PDF Document Reader outline tree processing when analyzing a PDF with a deeply nested or cyclic table of contents. A remote attacker can supply a crafted PDF to cause a denial of service.
The issue can trigger a StackOverflowError in the ingestion thread.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59279)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource allocation in the MCP Streamable HTTP server transport when handling repeated initialize requests. A remote attacker can send repeated initialize requests to cause a denial of service.
The issue affects the WebFlux and WebMvc variants, and authentication is not required by default.
4) Path traversal (CVE-ID: CVE-2026-59294)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to write arbitrary files.
The vulnerability exists due to path traversal in ResourceCacheService.getCacheName() when handling model or tokenizer URIs from a less-trusted source. A remote user can supply a URI with a crafted fragment to write arbitrary files.
Exploitation requires an application to pass model or tokenizer URIs from a less-trusted source, such as tenant configuration, an admin UI, or an external catalogue, to TransformersEmbeddingModel.setModelResource() or setTokenizerResource().
5) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-59308)
CWE-ID: CWE-668 - Exposure of resource to wrong sphere
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose cached responses across unrelated contexts.
The vulnerability exists due to improper isolation in semantic cache context hash handling when processing cached responses for different system prompts. A remote user can cause a cache key collision to disclose cached responses across unrelated contexts.
The issue affects cross-tenant isolation in Spring AI semantic cache support.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose chat messages from other conversations.
The vulnerability exists due to improper neutralization of special elements in RedisChatMemoryRepository.findByMetadata() when building RediSearch tag queries from caller-supplied metadata values. A remote user can supply a crafted metadata value to disclose chat messages from other conversations.
The issue affects applications that pass user-controlled values to findByMetadata() on a tag-typed metadata field.
7) Improper access control (CVE-ID: CVE-2026-59318)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to invoke a tool that was not made available to the current request, potentially leading to privilege escalation.
The vulnerability exists due to improper access control in DefaultToolCallingManager tool calling support when dispatching tool calls after processing prompt-injected input. A remote user can cause dispatch of an unadvertised tool to invoke a tool that was not made available to the current request, potentially leading to privilege escalation.
User interaction is required.
Remediation
Install update from vendor's website.