Spring security advisory (AV26-245)

Serial number: AV26-245

Date: March 17, 2026

On March 17, 2026, Spring published security advisories to address vulnerabilities in the following product:

• Spring AI – 1.0.x versions prior to 1.0.4
• Spring AI – 1.1.x versions prior to 1.1.3

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter
• CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
• Spring Security Advisories