CVE-2026-59308
MEDIUMCVSS 4.3/10EPSS 0.22%
Last modified
CVE-2026-59308 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Ai | >= 2.0.0, < 2.0.1 |
References
- https://spring.io/security/cve-2026-59308Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-59308?
In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts.
Affected versions:
Spring AI: 2.0.0
How severe is CVE-2026-59308?
CVE-2026-59308 has a CVSS score of 4.3/10 (MEDIUM severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.
How do I fix CVE-2026-59308?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-59302Potential for logging sensitive data in Spring Cloud Stream.…4.9
- CVE-2026-59303Dynamic destination cache size is not properly bound in Spri…3.8
- CVE-2026-59304Improper caching of the original content type in Spring Clou…3.8
- CVE-2026-59305Partition interceptor may be improperly added while sending …3.8
- CVE-2026-59306Potential for deserialization of untrusted types in Spring C…3.8
- CVE-2026-59307An operator who calls JdbcMessageStore.addAllowedPatterns(..…8
- CVE-2026-59309VMware vCenter contains an authentication bypass vulnerabili…9.8
- CVE-2026-59310VMware vCenter contains a directory traversal vulnerability …9.8
- CVE-2026-59311A local unprivileged user on the same host can redirect all …6.8
- CVE-2026-59313Spring MVC applications using the functional web framework a…9.8
- CVE-2026-59314Applications that build a Content-Disposition header value f…3.7
- CVE-2026-59315The Spring Cloud Config Monitor is susceptible to Denial of …5.3
Are you affected by CVE-2026-59308?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST