---
id: CVE-2026-59308
title: >-
  In Spring AI's Semantic Cache support, the context hash used to isolate cached
  responses between different system prompts could allow cached responses to be
  shared across unrelated contexts.

  Affected versions:

  Spring AI: 2.0.0
summary: >-
  In Spring AI's Semantic Cache support, the context hash used to isolate cached
  responses between different system prompts could allow cached responses to be
  shared across unrelated contexts.

  Affected versions:

  Spring AI: 2.0.0
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-668
vendor: vmware
product: spring_ai
affected:
  - 'spring_ai >= 2.0.0, < 2.0.1'
patched:
  - spring_ai 2.0.1
published: '2026-08-21'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T14:06:31.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59308'
references:
  - url: 'https://spring.io/security/cve-2026-59308'
    label: security@vmware.com
tags:
  - nvd
epss: 0.00224
epssPercentile: 0.1155
ingestedAt: '2026-09-16T14:57:28.003Z'
---

## Overview

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts.
Affected versions:
Spring AI: 2.0.0

## Affected

- `spring_ai >= 2.0.0, < 2.0.1`

## Remediation

Upgrade past the affected range:

- `spring_ai 2.0.1`