Spring AI Chat Memory Component Unintended Data Exposure Vulnerability

A vulnerability in Spring AI's chat memory component could lead to unintended data exposure between users. This issue arises from a default setting that, if not explicitly changed, may allow data to be shared across user sessions.

Impact

Exploitation of this vulnerability could result in cross-user data leakage, allowing one user to access another user's data unintentionally.

Remediation

Users should upgrade to Spring AI version 1.0.7 or 1.1.6, depending on their current version. After upgrading, ensure that all 'ChatClient' calls using memory advisors explicitly set the conversation identifier, as the update removes the implicit default conversation ID.