Spring security advisory (AV26-288)

[MalBot]

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

  <div>
<div>

        <div><p><strong>Serial number: </strong>AV26-288<br /><strong>Date: </strong>March 26, 2026</p>

Between March 23 and 26, 2026, Spring published security advisories to address vulnerabilities in the following products:

• Spring Cloud Config – versions prior to 3.1.3, 4.1.9, 4.2.6, 4.3.2 and 5.0.2
• Spring AI – versions prior to 1.0.5 and 1.1.4

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• CVE-2026-22739: Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
• CVE-2026-22743: Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore
• CVE-2026-22744: RediSearch Query via Unescaped TAG Filter Values in RedisVectorStore
• CVE-2026-22742: Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching
• CVE-2026-22738: SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution
• Spring Security Advisories

</div>

Article Link: Spring security advisory (AV26-288) - Canadian Centre for Cyber Security