CVE-2026-41713: VMware Spring AI prompt injection in conversation memory

CVE-2026-41713 · Severity: high · CVSS 8.2 · Published 2026-05-12

Spring AI is a framework used to integrate Artificial Intelligence capabilities into Java applications. A vulnerability in its conversation memory component allows malicious users to 'poison' a chat history with specially crafted text. This can trick the AI into ignoring its safety instructions or performing unintended actions in future interactions, potentially leading to unauthorized data access or manipulation of the application's logic.

Technologies: VMware Spring Ai. Vendors: Broadcom, Maven, VMware.

Quick answers

Is CVE-2026-41713 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41713 being exploited in the wild.
How severe is CVE-2026-41713?
High severity, with a CVSS score of 8.2, published 12 May 2026.
Which products and versions are affected?
org.springframework.ai:spring-ai-client-chat (Maven) ECOSYSTEM:introduced=0,fixed=1.0.7; VMware Spring Ai All versions prior to fix.
Is there a fix for CVE-2026-41713?
Yes. org.springframework.ai:spring-ai-client-chat (Maven): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41713 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41713?
Check whether you run Broadcom AI Client Chat, org.springframework.ai:spring-ai-client-chat (Maven) or VMware Spring Ai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.ai:spring-ai-client-chat (Maven): upgrade to 1.0.7 or later
    # set org.springframework.ai:spring-ai-client-chat to 1.0.7 in your pom.xml or build.gradle

Technical details

A prompt injection vulnerability exists in the Spring AI 'PromptChatMemoryAdvisor' component due to improper neutralization of special elements (CWE-1336). When an application stores user-controlled input in conversation memory, an attacker can craft malicious input that is later interpreted as instructions rather than data when the model retrieves that history. This 'memory poisoning' allows an attacker to bypass system prompts and manipulate the LLM's behavior in subsequent conversation turns. The vulnerability is reachable over the network without authentication or user interaction. Patches are available in versions 1.0.7 and 1.1.6.

Affected products

  • Spring spring-ai-client-chat < 1.0.7, >= 1.1.0-M1, < 1.1.6

Identifiers

  • CVE-2026-41713
  • GHSA-5852-phmh-8fhr

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory
  • 2026-05-18: patched: Advisory updated with reviewed status and patched versions.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.