What is the CVSS score of CVE-2026-41713?

CVE-2026-41713 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring AI are affected by CVE-2026-41713?

VMware Spring AI contains a conversation memory poisoning vulnerability (CVE-2026-41713, CVSS 8.2) that allows unauthenticated remote attackers to inject malicious prompts that persist across…. A patch is available.

How to fix or mitigate CVE-2026-41713?

Within 24 hours: Inventory all applications using VMware Spring AI and assess whether they process untrusted user-generated conversational input. Within 7 days: Implement input validation and sanitization on all user-supplied conversation content before transmission to Spring AI; deploy rate limiting and anomaly detection on conversation endpoints to detect injection patterns. Within 30 days: Monitor VMware security advisories for vendor patch release; conduct threat modeling on AI-dependent workflows to identify high-risk use cases; evaluate alternative Spring AI versions or architectural isolation of conversational AI components from sensitive data flows.

Spring AI CVE-2026-41713

EUVD-2026-29449 HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-05-12 vmware

GHSA-5852-phmh-8fhr

Information Disclosure Ssti

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 12, 2026 - 12:02 EUVD

Analysis Generated

May 12, 2026 - 11:30 vuln.today

CVE Published

May 12, 2026 - 10:17 nvd

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

37 maven packages depend on org.springframework.ai:spring-ai-client-chat (6 direct, 31 indirect)

Ecosystem-wide dependent count for version 1.1.0-M1.

DescriptionCVE.org

A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.

AnalysisAI

Conversation memory poisoning in VMware Spring AI allows remote unauthenticated attackers to inject malicious input that persists across conversation turns and manipulates AI model behavior. The vulnerability achieves high integrity impact (CVSS 8.2) through stored prompt injection, enabling attackers to alter model responses, extract sensitive context, or bypass application logic without authentication. No active exploitation confirmed at time of analysis, but the network-accessible attack surface and low complexity make this a priority for applications processing user-generated conversational input.

Technical ContextAI

Spring AI is VMware's framework for building AI-powered applications with conversation memory capabilities. This vulnerability exploits CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), manifesting as Server-Side Template Injection (SSTI) within the conversation memory layer. The flaw occurs when user-controlled input is stored in conversation context without proper sanitization, then later retrieved and processed by the language model as instructions rather than data. The CPE identifier (cpe:2.3:a:vmware:spring_ai) indicates the core Spring AI library is affected. This represents a stored injection attack where malicious prompts persist in memory state and influence subsequent model invocations, similar to traditional stored XSS but targeting LLM reasoning instead of web browsers.

RemediationAI

Consult the VMware Spring AI security advisory at https://spring.io/security/cve-2026-41713 for patch version and upgrade instructions. Primary remediation is upgrading to the patched Spring AI release that implements proper input sanitization in conversation memory handling. Until patching is complete, implement defense-in-depth controls: (1) Apply strict input validation to filter prompt injection attempts before storing in conversation memory, though this may reduce legitimate use cases for special characters and may be bypassed by novel injection techniques. (2) Implement conversation memory isolation per user session to prevent cross-session contamination, which adds architectural complexity but limits blast radius. (3) Add output filtering to detect and block unexpected model behavior patterns, noting this is reactive rather than preventive. (4) Consider disabling conversation memory features in the advisor configuration for internet-facing applications processing untrusted input, which eliminates the vulnerability but removes multi-turn conversation capabilities. Evaluate trade-offs between security and functionality based on application requirements and user trust boundaries.