CVE-2026-41713: falha de alta gravidade em VMware Spring AI
Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.4%
probabilidade de exploração
0.4%top 73% das CVEs
exploração observada
nãonenhuma fonte reporta
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Produtos afetados
VMware · Spring AICVEs relacionadas — VMware Spring AI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-22729HIGHCVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverterEPSS 0.5%CVE-2026-22730HIGHCVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverterEPSS 0.5%CVE-2026-41712HIGHChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakageEPSS 0.4%CVE-2026-40966MEDIUMVectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltrationEPSS 0.4%