What’s Vulnerable › Vulnerabilities

CVE-2026-59308: Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-21 · updated 2026-10-16
• Weakness: CWE-668

Description

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0

Affected products

• Spring AI: from 2.0.0 before 2.0.1 — fixed in 2.0.1
• Spring AI: 2.0.0

How to fix

Upgrade to a fixed version: Spring AI 2.0.1. Check the vendor advisory for mitigations.

References

• https://spring.io/security/cve-2026-59308

Get alerted when CVE-2026-59308 or the next vulnerability affects your stack