What is the CVSS score of EUVD-2026-36796?

EUVD-2026-36796 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.5%.

Which versions of Spring AI are affected by EUVD-2026-36796?

Spring AI Vector Stores (versions 1.0.0-1.0.8 and 1.1.0-1.1.7) are vulnerable to remote NoSQL injection attacks that allow unauthenticated actors to execute arbitrary queries against Elasticsearch,…. A patch is available.

How to fix or mitigate EUVD-2026-36796?

24 hours: Audit all applications and infrastructure to identify Spring AI deployments using versions 1.0.0-1.0.8 or 1.1.0-1.1.7. 7 days: Implement input sanitization and character validation for all user-supplied text fed to Spring AI vector stores, apply network segmentation to limit vector database access, and document risk acceptance. 30 days: Monitor Spring Framework announcements for patched versions (Spring AI 1.0.9+ or 1.1.8+); upgrade immediately upon release or transition to alternative vector-store libraries if no patch timeline is disclosed.

Spring AI EUVD-2026-36796

| CVE-2026-47835 HIGH

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-06-15 vmware

GHSA-cmwh-w62w-r2mf

Java Information Disclosure Spring Elastic Nosql Injection Spring Ai

8.6

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

8.6 HIGH

Remote network-exposed RAG endpoints accept untrusted input with no auth or interaction (AV:N/AC:L/PR:N/UI:N); injection yields full index reads (C:H) but only limited tampering and disruption (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 15, 2026 - 21:01 EUVD

Analysis Generated

Jun 15, 2026 - 19:55 vuln.today

CVE Published

Jun 15, 2026 - 18:54 cve.org

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.springframework.ai:spring-ai-elasticsearch-store (1 direct, 0 indirect)
1 maven packages depend on org.springframework.ai:spring-ai-gemfire-store (1 direct, 0 indirect)
2 maven packages depend on org.springframework.ai:spring-ai-opensearch-store (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.0 and other introduced versions.

DescriptionCVE.org

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store.

Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).

Articles & Coverage 2

News 3 New Java Vulnerabilities - 3 High Severity Jun 16, 2026 News 3 New Java Vulnerabilities - 3 High Severity, No Public Exploits Jun 15, 2026

AnalysisAI

NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers to inject special characters into vector-store inputs and force execution of arbitrary queries against Elasticsearch, OpenSearch, and GemFire VectorDB backends. The flaw resides in the spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store components, enabling information disclosure and limited integrity/availability impact against any application embedding Spring AI's vector-store abstraction. No public exploit identified at time of analysis, but the CVSS 8.6 (scope unchanged here, network vector, no privileges) makes this a high-priority patch for any Spring AI deployment ingesting untrusted text.

Technical ContextAI

Spring AI is VMware/Broadcom's framework for building generative-AI applications on the JVM, and its Vector Stores module provides a uniform abstraction over vector databases used in RAG (retrieval-augmented generation) pipelines. The affected modules - spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store - translate Java-level filter expressions and metadata predicates into native queries (Elasticsearch/OpenSearch Query DSL JSON and GemFire OQL). CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) indicates that special characters in user-controlled inputs are not properly escaped or parameterized when constructing those queries, allowing an attacker to break out of the intended query structure. Because CPE coverage is spring:spring_ai:* (all versions of the framework prior to the fixes), any downstream application that exposes Spring AI search functionality to untrusted callers inherits the vulnerability.

RemediationAI

Vendor-released patches are available: upgrade Spring AI to 1.0.9 (for the 1.0.x line) or 1.1.8 (for the 1.1.x line) as documented at https://spring.io/security/cve-2026-47835, ensuring any transitive dependency on spring-ai-elasticsearch-store, spring-ai-opensearch-store, or spring-ai-gemfire-store is pinned to the fixed versions. Where immediate upgrade is not possible, compensating controls include rejecting or sanitizing user input containing query-DSL metacharacters before it reaches VectorStore.similaritySearch() or filter expression APIs, restricting the Elasticsearch/OpenSearch/GemFire credentials used by the application to a least-privilege role scoped to the specific vector index (so injected queries cannot read unrelated indices), and placing an application-level allowlist on metadata filter fields; note that aggressive input filtering can break legitimate prompts containing punctuation, and credential scoping requires re-provisioning datastore roles which may impact other workloads sharing the same cluster.