CVE-2026-59308Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation

Description

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://spring.io/security/cve-2026-59308 Vendor Advisory