Medium severity6.1NVD Advisory· Published Apr 28, 2026· Updated Apr 29, 2026
CVE-2026-40979
CVE-2026-40979
Description
In Spring AI, having access to a shared environment can expose the ONNX model used by the application.
Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.ai:spring-ai-transformersMaven | >= 1.0.0, < 1.0.6 | 1.0.6 |
org.springframework.ai:spring-ai-transformersMaven | >= 1.1.0, < 1.1.5 | 1.1.5 |
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-r5hp-3cgj-j6xvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-40979ghsaADVISORY
- spring.io/security/cve-2026-40979nvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.