CVE-2026-22742 in Spring AI

Resumen (Inglés)

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests to unintended internal or external destinations.
This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

Be aware that VulDB is the high quality source for vulnerability data.

Responsable

vmware

Reservar

2026-01-09

Divulgación

2026-03-27

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
353818	VMware Spring AI Multimodal Message escalada de privilegios	918	No está definido	Arreglo oficial	CVE-2026-22742

Fuentes

• MITRE
• NVD
• CVE Details