Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreCVE-2026-41705: Expression injection in MilvusVectorStore doDelete allows data destruction
Description
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.
Affected Spring Products and Versions
Spring AI:
- 1.0.0 - 1.0.x
- 1.1.0 - 1.1.x
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 1.0.x | 1.0.7 | OSS |
| 1.1.x | 1.1.6 | OSS |
No further mitigation steps are necessary.
Credit
The issue was reported responsibly by
- sharlongwen
References
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all