Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
Recommended action: Upgrade to 2.0.0-M6 (pre-release), 1.1.6 or 1.0.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
Recommended action: Upgrade to 1.1.6 or 1.0.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.