Vulnerability Description
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Spring AI 2.0.0
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Ai | >= 2.0.0, < 2.0.1 |
Related Weaknesses (CWE)
References
- https://spring.io/security/cve-2026-59319Vendor Advisory
FAQ
What is CVE-2026-59319?
CVE-2026-59319 is a vulnerability with a CVSS score of 4.3 (MEDIUM). RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRa...
How severe is CVE-2026-59319?
CVE-2026-59319 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59319?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Spring Ai.