Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Affected packages

• org.springframework.ai:spring-ai-advisors-vector-store— before 1.0.7
• org.springframework.ai:spring-ai-client-chat— before 1.0.7
• org.springframework.ai:spring-ai-model— before 1.0.7

Exploit signal

Known exploited (CISA KEV)

No

EPSS score

—

EPSS percentile

—

EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.