CVE-2026-22742: Spring Ai: sunucu taraflı istek sahteciliği (SSRF)

Açıklama (NVD)

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests to unintended internal or external destinations. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

Özet bilgiler

Ürün

Vmware Spring Ai

CVSS v3.1

8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

%0,36 (yüzdelik 30)

CWE

CWE-918

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• spring.io
• CWE-918