VulnerabilityUndergoing Analysis

CVE-2026-59308

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts.

MEDIUM 4.2EPSS 0.16%

Does this matter?

Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.

Description

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0

CVSS 3.1: 4.2 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.16% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-668
Source: security@vmware.com

References

https://spring.io/security/cve-2026-59308

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.