Description

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

Affected Spring Products and Versions

Spring AI:

• 1.0.0 - 1.0.x
• 1.1.0 - 1.1.x

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Note: This fix removes the implicit default conversation ID. Applications that do not explicitly pass a conversationId to memory advisors will throw an exception after upgrading. Before upgrading, ensure all ChatClient calls using memory advisors explicitly set the conversation identifier via .advisors(a -> a.param(ChatMemory.CONVERSATION_ID, id)).

Credit

The issue was reported responsibly by

• Ahmed Sekka (GitHub: https://github.com/ahmed-sekka)
• sharlongwen

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1

History