Spring AI CVE-2026-40966

Vendors must release a patched version of Spring AI that implements input validation and sanitization on the conversationId parameter, or enforce static, application-generated conversation identifiers rather than accepting user-supplied input. Affected applications should immediately audit code to identify any instances where conversationId is derived from user input, and implement one of the following compensating controls: (1) Use static, server-generated conversation identifiers instead of user-supplied values, regenerating them server-side and mapping them to user sessions; (2) If user-supplied conversationId is required, implement strict allowlist validation (e.g., alphanumeric characters only, maximum length) before passing to VectorStoreChatMemoryAdvisor; (3) Add database-layer access control to ensure queries for conversation history include an explicit user/session identifier filter that cannot be bypassed by conversationId injection. The first option eliminates the attack surface entirely with no performance impact. The second requires careful payload analysis to ensure the allowlist cannot be circumvented. The third adds query construction complexity but allows user-facing conversationId if needed. Monitor conversation history retrieval logs for anomalous patterns (requests accessing conversations belonging to different user sessions). For non-vulnerable versions and patched releases, consult https://spring.io/security/cve-2026-40966.