Spring security advisory (AV26-397)

Serial number: AV26-397
Date: April 27, 2026

On April 27, 2026, Spring published security advisories to address vulnerabilities in the following product:

• Spring AI – 1.0.x versions prior to 1.0.6
• Spring AI – 1.1.x versions prior to 1.1.5

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• CVE-2026-40967: VectorStore FilterExpression Converter injection
• CVE-2026-40978: SQL Injection in CosmosDBVectorStore.doDelete()
• Spring Security Advisories