CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-22742

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests to unintended internal or external destinations. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 15.5%

CVSS Severity

CVSS v3 Score 8.6

References

https://spring.io/security/cve-2026-22742

Products affected by CVE-2026-22742

Vmware » Spring Ai » Version: 1.0.0

cpe:2.3:a:vmware:spring_ai:1.0.0
Vmware » Spring Ai » Version: 1.0.1

cpe:2.3:a:vmware:spring_ai:1.0.1
Vmware » Spring Ai » Version: 1.0.2

cpe:2.3:a:vmware:spring_ai:1.0.2
Vmware » Spring Ai » Version: 1.0.3

cpe:2.3:a:vmware:spring_ai:1.0.3
Vmware » Spring Ai » Version: 1.0.4

cpe:2.3:a:vmware:spring_ai:1.0.4
Vmware » Spring Ai » Version: 1.1.0

cpe:2.3:a:vmware:spring_ai:1.1.0
Vmware » Spring Ai » Version: 1.1.1

cpe:2.3:a:vmware:spring_ai:1.1.1
Vmware » Spring Ai » Version: 1.1.2

cpe:2.3:a:vmware:spring_ai:1.1.2
Vmware » Spring Ai » Version: 1.1.3

cpe:2.3:a:vmware:spring_ai:1.1.3

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-22742

Products

Pricing

Contact Us