Description
In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts.
Affected versions:
Spring AI: 2.0.0
Published: 2026-08-21
Score: 4.2 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://spring.io/security/cve-2026-59308 cve-icon cve-icon
History

Fri, 21 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Description In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0
Title Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation
Weaknesses CWE-668
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-08-21T12:07:07.992Z

Reserved: 2026-07-04T18:13:46.709Z

Link: CVE-2026-59308

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-21T12:16:30.270

Modified: 2026-08-21T12:16:30.270

Link: CVE-2026-59308

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-668

    Exposure of Resource to Wrong Sphere