Skip to content

Commit 92659e8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-44f4-gvwj-6qg3 GHSA-46wh-3698-f2cx GHSA-44f4-gvwj-6qg3
1 parent f3334b1 commit 92659e8

3 files changed

Lines changed: 207 additions & 34 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-44f4-gvwj-6qg3/GHSA-44f4-gvwj-6qg3.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-44f4-gvwj-6qg3",
4+
"modified": "2026-03-29T15:36:29Z",
5+
"published": "2026-03-27T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-22744"
8+
],
9+
"summary": "Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters",
10+
"details": "In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping characters. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.springframework.ai:spring-ai-redis-store"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.0.0-M5"
29+
},
30+
{
31+
"fixed": "1.0.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.springframework.ai:spring-ai-redis-store"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "1.1.0-M1"
48+
},
49+
{
50+
"fixed": "1.1.4"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22744"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/spring-projects/spring-ai/commit/707e990c9152aabb9c9226053725efa2ada72223"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/spring-projects/spring-ai"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/spring-projects/spring-ai/releases/tag/v1.0.5"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/spring-projects/spring-ai/releases/tag/v1.1.4"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://spring.io/security/cve-2026-22744"
81+
}
82+
],
83+
"database_specific": {
84+
"cwe_ids": [
85+
"CWE-74",
86+
"CWE-943"
87+
],
88+
"severity": "HIGH",
89+
"github_reviewed": true,
90+
"github_reviewed_at": "2026-03-29T15:36:29Z",
91+
"nvd_published_at": "2026-03-27T06:16:38Z"
92+
}
93+
}

‎advisories/github-reviewed/2026/03/GHSA-46wh-3698-f2cx/GHSA-46wh-3698-f2cx.json‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-46wh-3698-f2cx",
4+
"modified": "2026-03-29T15:37:29Z",
5+
"published": "2026-03-29T15:37:28Z",
6+
"aliases": [],
7+
"summary": "Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)",
8+
"details": "## Summary\n\nThere is a potential vulnerability in Traefik due to its dependency on an affected version of gRPC-Go (CVE-2026-33186).\n\nA remote, unauthenticated attacker can send gRPC requests with a malformed HTTP/2 `:path` pseudo-header omitting the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server routes such requests correctly, path-based authorization interceptors evaluate the raw non-canonical path and fail to match \"deny\" rules, allowing the request to bypass the policy entirely if a fallback \"allow\" rule is present.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.42\n- https://github.com/traefik/traefik/releases/tag/v3.6.12\n- https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3\n\n## For more information\n\nIf there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n### Summary\nThis CVE hits traefik until Version 3.6.11 and 2.11.41.\ngRPC-Go has an authorization bypass via missing leading slash in :path\n### Details\nAs described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3\n### PoC\nUpdate library version in \nhttps://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L108\n### Impact\nIs described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3\n\n</details>\n\n\n----------",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/traefik/traefik/v2"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2.11.42"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "Go",
38+
"name": "github.com/traefik/traefik/v3"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "3.0.0-beta3"
46+
},
47+
{
48+
"fixed": "3.6.12"
49+
}
50+
]
51+
}
52+
]
53+
},
54+
{
55+
"package": {
56+
"ecosystem": "Go",
57+
"name": "github.com/traefik/traefik/v3"
58+
},
59+
"ranges": [
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "3.7.0-ea.1"
65+
},
66+
{
67+
"fixed": "3.7.0-ea.3"
68+
}
69+
]
70+
}
71+
]
72+
}
73+
],
74+
"references": [
75+
{
76+
"type": "WEB",
77+
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-46wh-3698-f2cx"
78+
},
79+
{
80+
"type": "ADVISORY",
81+
"url": "https://github.com/advisories/GHSA-p77j-4mvh-x3m3"
82+
},
83+
{
84+
"type": "PACKAGE",
85+
"url": "https://github.com/traefik/traefik"
86+
},
87+
{
88+
"type": "WEB",
89+
"url": "https://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L108"
90+
},
91+
{
92+
"type": "WEB",
93+
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.42"
94+
},
95+
{
96+
"type": "WEB",
97+
"url": "https://github.com/traefik/traefik/releases/tag/v3.6.12"
98+
},
99+
{
100+
"type": "WEB",
101+
"url": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3"
102+
}
103+
],
104+
"database_specific": {
105+
"cwe_ids": [
106+
"CWE-1395",
107+
"CWE-285"
108+
],
109+
"severity": "HIGH",
110+
"github_reviewed": true,
111+
"github_reviewed_at": "2026-03-29T15:37:28Z",
112+
"nvd_published_at": null
113+
}
114+
}

‎advisories/unreviewed/2026/03/GHSA-44f4-gvwj-6qg3/GHSA-44f4-gvwj-6qg3.json‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

0 commit comments

Comments
 (0)