CVE-2026-59308
Received Received - Intake

Semantic Cache Context Isolation Flaw in Spring AI

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VMware

Description
In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-59308
EUVD
EUVD-2026-63932

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
spring_ai spring_ai to 2.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Spring AI's Semantic Cache support involves a flawed context hash mechanism that isolates cached responses. Due to SHA-256 truncation, cached responses could be shared across unrelated system prompts, potentially allowing data leakage between different contexts.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to cached data from different users or systems, causing information disclosure or cross-tenant data exposure. Attackers might retrieve sensitive responses intended for other contexts.

Compliance Impact

This vulnerability could violate data isolation requirements in GDPR and HIPAA by enabling unauthorized access to personal or health data across different contexts. Organizations may face compliance penalties due to potential data breaches.

Mitigation Strategies

Upgrade to Spring AI 2.0.1 for OSS or 2.0.0.1 for Enterprise Support. No further mitigation steps are necessary as per the vendor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59308. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart