CVE-2026-40967

Spring / Spring AI PUBLISHED

Description (CNA)

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

Affected (CNA)

Vendor / product	Versions
Spring / Spring AI	affected 1.0.0 before 1.0.6; affected 1.1.0 before 1.1.5

CWE

CWE-94

References

https://spring.io/security/cve-2026-40967

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.