Spring Security Advisories

RSS feed

ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

HIGH | MAY 08, 2026 | CVE-2026-41712

Description

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

Affected Spring Products and Versions

Spring AI:

  • 1.0.0 - 1.0.6
  • 1.1.0 - 1.1.5

Affected Spring Products and Versions

Spring AI:

  • 1.1.0 - 1.1.5
  • 1.0.0 - 1.0.6

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
1.1.6OSS
1.0.7OSS

Note: This fix removes the implicit default conversation ID. Applications that do not explicitly pass a conversationId to memory advisors will throw an exception after upgrading. Before upgrading, ensure all ChatClient calls using memory advisors explicitly set the conversation identifier via .advisors(a -> a.param(ChatMemory.CONVERSATION_ID, id)).

Credit

The issue was reported responsibly by

References

History

  • 2026-05-08: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all