Skip to content
Threat Feed

Product

Spring AI (1.1.x < 1.1.5)

1 brief RSS
high advisory

Spring AI Vulnerabilities CVE-2026-40967 and CVE-2026-40978

Spring released security advisories on April 27, 2026, to address a VectorStore FilterExpression Converter injection vulnerability (CVE-2026-40967) and a SQL Injection vulnerability (CVE-2026-40978) in Spring AI versions prior to 1.0.6 and 1.1.5.

Spring AI +1 vulnerability sql-injection code-injection spring-ai
2r 1t 2c