What is the CVSS score of CVE-2026-22742?

CVE-2026-22742 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-22742?

Spring AI Bedrock Converse versions 1.0.0-1.0.4 and 1.1.0-1.1.3 contain a server-side request forgery vulnerability that allows unauthenticated remote attackers to manipulate the application server…. A patch is available.

How to fix or mitigate CVE-2026-22742?

Within 24 hours: Inventory all applications using Spring AI Bedrock Converse and identify affected versions (1.0.0-1.0.4, 1.1.0-1.1.3). Within 7 days: Implement network-level compensating controls (see below) and restrict multimodal message handling where operationally feasible. Within 30 days: Monitor Spring AI project for patched release versions and prepare upgrade deployment; escalate to development teams for testing and staged rollout once patches become available.

Java CVE-2026-22742

EUVD-2026-16537 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-27 vmware

GHSA-mhrg-94vw-45c5

Java SSRF

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 20:22 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 27, 2026 - 06:00 euvd

EUVD-2026-16537

Analysis Generated

Mar 27, 2026 - 06:00 vuln.today

CVE Published

Mar 27, 2026 - 05:27 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.springframework.ai:spring-ai-bedrock-converse (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.0-M5.

DescriptionCVE.org

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests to unintended internal or external destinations. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

AnalysisAI

Server-Side Request Forgery in Spring AI Bedrock Converse module enables unauthenticated remote attackers to force the application server to issue HTTP requests to arbitrary internal or external destinations by supplying malicious media URLs in multimodal messages. Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 are affected. The vulnerability carries a CVSS score of 8.6 with high confidentiality impact and changed scope, indicating potential access to internal network resources. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in the BedrockProxyChatModel component of spring-ai-bedrock-converse, which is part of the Spring AI framework (cpe:2.3:a:spring:spring_ai). Spring AI provides abstractions for integrating AI models, and the Bedrock Converse module specifically handles multimodal messaging with Amazon Bedrock services. The root cause is insufficient URL validation when processing user-supplied media URLs embedded in multimodal messages. When the application processes these messages, it fetches content from the provided URLs without proper allowlist validation or SSRF protections, enabling attackers to abuse the server as a proxy to access internal services, cloud metadata endpoints (e.g., AWS metadata at 169.254.169.254), or external systems. This is a classic SSRF vulnerability class allowing URL injection attacks.

RemediationAI

Upgrade Spring AI to version 1.0.5 or later for the 1.0.x branch, or to version 1.1.4 or later for the 1.1.x branch, as documented in the Spring security advisory at https://spring.io/security/cve-2026-22742. Until patching is completed, implement defense-in-depth measures including network-level egress filtering to block access to internal IP ranges (RFC 1918 addresses, link-local addresses including 169.254.0.0/16) and cloud metadata endpoints from application servers, application-layer URL validation with strict allowlists for permitted media domains, and disabling multimodal message processing if not required for business operations. Organizations should also review application logs for suspicious outbound HTTP requests that may indicate exploitation attempts or reconnaissance activity.