HIGH7.5
GHSA-q62f-h9x2-gcqc
Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
Quick fix
GHSA-q62f-h9x2-gcqc — org.springframework.ai:spring-ai-client-chat: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.0.7</version> for org.springframework.ai:spring-ai-client-chatDetails
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.springframework.ai:spring-ai-client-chat
Introduced in:
0Fixed in: 1.0.7Fix
# pom.xml: bump <version>1.0.7</version> for org.springframework.ai:spring-ai-client-chatMaven/org.springframework.ai:spring-ai-client-chat
Introduced in:
1.1.0-M1Fixed in: 1.1.6Fix
# pom.xml: bump <version>1.1.6</version> for org.springframework.ai:spring-ai-client-chatMaven/org.springframework.ai:spring-ai-client-chat
Introduced in:
2.0.0-M1Fixed in: 2.0.0-M6Fix
# pom.xml: bump <version>2.0.0-M6</version> for org.springframework.ai:spring-ai-client-chatMaven/org.springframework.ai:spring-ai-model
Introduced in:
0Fixed in: 1.0.7Fix
# pom.xml: bump <version>1.0.7</version> for org.springframework.ai:spring-ai-modelMaven/org.springframework.ai:spring-ai-model
Introduced in:
1.1.0-M1Fixed in: 1.1.6Fix
# pom.xml: bump <version>1.1.6</version> for org.springframework.ai:spring-ai-modelMaven/org.springframework.ai:spring-ai-model
Introduced in:
2.0.0-M1Fixed in: 2.0.0-M6Fix
# pom.xml: bump <version>2.0.0-M6</version> for org.springframework.ai:spring-ai-modelMaven/org.springframework.ai:spring-ai-advisors-vector-store
Introduced in:
0Fixed in: 1.0.7Fix
# pom.xml: bump <version>1.0.7</version> for org.springframework.ai:spring-ai-advisors-vector-storeMaven/org.springframework.ai:spring-ai-advisors-vector-store
Introduced in:
1.1.0-M1Fixed in: 1.1.6Fix
# pom.xml: bump <version>1.1.6</version> for org.springframework.ai:spring-ai-advisors-vector-storeMaven/org.springframework.ai:spring-ai-advisors-vector-store
Introduced in:
2.0.0-M1Fixed in: 2.0.0-M6Fix
# pom.xml: bump <version>2.0.0-M6</version> for org.springframework.ai:spring-ai-advisors-vector-store