Spring security advisory (AV26-443)

Serial number: AV26-443
Date: May 11, 2026

On May 8, 2026, Spring published security advisories to address vulnerabilities in the following products:

• Spring AI – 1.0.x versions prior to 1.0.7
• Spring AI – 1.1.x versions prior to 1.1.6

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• CVE-2026-41705: Expression injection in MilvusVectorStore doDelete allows data destruction
• CVE-2026-41713: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
• CVE-2026-41712: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
• Spring Security Advisories