What is the CVSS score of EUVD-2026-28875?

EUVD-2026-28875 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Spring AI are affected by EUVD-2026-28875?

Spring AI's MilvusVectorStore contains a filter-expression injection vulnerability (CVE-2026-41705) that allows unauthenticated remote attackers to manipulate vector database queries, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-28875?

Within 24 hours: Identify all applications running Spring AI 1.0.0-1.0.6 or 1.1.0-1.1.5 using MilvusVectorStore and isolate them from untrusted networks if possible. Within 7 days: Upgrade to Spring AI 1.0.7 or 1.1.6 (vendor-released patches). Within 30 days: Conduct full regression testing on upgraded deployments and validate vector query behavior to confirm injection attacks are blocked.

Spring AI EUVD-2026-28875

| CVE-2026-41705 HIGH

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-05-09 vmware

GHSA-v632-2m87-7469

Code Injection Java

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 09, 2026 - 02:16 EUVD

Analysis Generated

May 09, 2026 - 01:31 vuln.today

CVE Published

May 09, 2026 - 00:34 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.springframework.ai:spring-ai-milvus-store (1 direct, 1 indirect)
1 maven packages depend on org.springframework.ai:spring-ai-typesense-store (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.0 and other introduced versions.

DescriptionCVE.org

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 or greater.

AnalysisAI

Filter-expression injection in Spring AI's MilvusVectorStore allows remote unauthenticated attackers to manipulate vector database queries by injecting malicious filter expressions through unsanitized document IDs. Affects Spring AI 1.0.0-1.0.6 and 1.1.0-1.1.5. VMware has released patches in versions 1.0.7 and 1.1.6. CVSS 8.6 (High) with network attack vector and no privileges required. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.

Technical ContextAI

Spring AI is VMware's application framework for building AI-powered applications in Java, providing abstractions for vector databases and large language models. The vulnerability exists in the MilvusVectorStore component, which interfaces with Milvus vector databases for similarity search and retrieval-augmented generation (RAG) workflows. The doDelete(List) method fails to sanitize document IDs before incorporating them into filter expressions sent to the Milvus database. This is a CWE-917 (Expression Language Injection) vulnerability where attacker-controlled data is interpreted as executable filter logic rather than literal identifiers. The affected CPE (cpe:2.3:a:spring:spring_ai) indicates this is specific to Spring AI's vector store implementations, not the broader Spring Framework ecosystem.

RemediationAI

Upgrade to Spring AI 1.0.7 or later for the 1.0.x branch, or upgrade to Spring AI 1.1.6 or later for the 1.1.x branch, as specified in VMware's security advisory at https://spring.io/security/cve-2026-41705. The patched versions implement proper input sanitization in the MilvusVectorStore doDelete method to prevent filter-expression injection. If immediate patching is not feasible, implement strict input validation on document IDs before passing them to vector store delete operations-specifically, whitelist alphanumeric characters and reject any IDs containing Milvus filter expression metacharacters (parentheses, logical operators, comparison operators). This workaround may break legitimate use cases requiring special characters in document identifiers and should be tested thoroughly. Additionally, apply principle of least privilege to Milvus database credentials used by Spring AI to limit blast radius of successful injection attacks-restrict delete permissions where possible and isolate vector store collections by trust boundary.