CVE-2026-47835CWE-943

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

High · published June 15, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store.

Affected versions:

Spring AI 1.0.0 through 1.0.x (fix 1.0.9).

Spring AI 1.1.0 through 1.1.x (fix 1.1.8).

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00421 · 35.4th percentile
Weakness
CWE-943 · Improper Neutralization of Special Elements in Data Query Logic
Published
2026-06-15T18:54Z
EPSS history
Timeline
  • 15 JUN 18:54Z
    Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
    cvelistv5