CVE-2026-40967

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40967
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40967.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40967
Aliases
Published
2026-04-28T06:03:51.857Z
Modified
2026-07-08T08:13:12.623685236Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
Summary
[none]
Details

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.

Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "fixed": "1.0.6"
                },
                {
                    "introduced": "1.1.0"
                },
                {
                    "fixed": "1.1.5"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40967.json",
    "cna_assigner": "vmware",
    "cwe_ids": [
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-ai

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-ai
Events
Introduced
fcd2803f36f35939c20ed152c9c1b0863fa35dcf
Fixed
057e111a93e61f911427a581207e853cf68085e9
Introduced
fa4c61eabeba0a69147b3c00a3b50380c1f25a75
Fixed
3d662709e1d5041efebf74753a6d119e5196952a
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.0.6"
        },
        {
            "introduced": "1.1.0"
        },
        {
            "fixed": "1.1.5"
        }
    ]
}

Affected versions

v1.*
v1.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40967.json"