CVE-2026-22744: 
Java vulnerability analysis and mitigation

CVE-2026-22744 is a RediSearch query injection vulnerability in the spring-ai-redis-store component of Spring AI, caused by unescaped TAG filter values in RedisFilterExpressionConverter. When a user-controlled string is passed as a filter value for a TAG field, the stringValue() method inserts it directly into the @field:{VALUE} RediSearch TAG block without sanitization, enabling injection attacks. Affected versions include Spring AI 1.0.0 through 1.0.x (before 1.0.5) and 1.1.0 through 1.1.x (before 1.1.4). The vulnerability was disclosed on March 26–27, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Spring Advisory, Feedly).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74), specifically within the RedisFilterExpressionConverter class of the spring-ai-redis-store library. The stringValue() method constructs RediSearch TAG filter expressions by directly concatenating user-supplied input into the @field:{VALUE} query block without escaping RediSearch-special characters (e.g., |, {, }, -). An unauthenticated remote attacker can craft a malicious filter value that breaks out of the intended TAG block and injects arbitrary RediSearch query logic. No authentication, user interaction, or special privileges are required to exploit this vulnerability (Spring Advisory, Feedly).

Successful exploitation allows an unauthenticated attacker to manipulate RediSearch filter expressions, potentially bypassing search filters and gaining unauthorized access to sensitive data stored in Redis vector stores. The primary impact is a high-severity confidentiality breach — attackers could retrieve data records they are not authorized to access by subverting query logic. Integrity and availability are not directly impacted by this vulnerability (Spring Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability requires no authentication, no user interaction, and is network-accessible, making it relatively straightforward to exploit if a PoC were to emerge. The EPSS score is approximately 0.031% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It was detected by Qualys scanner (detection ID 5009977) and is patched (Feedly).

1. Reconnaissance: Identify applications using spring-ai-redis-store versions 1.0.0–1.0.4 or 1.1.0–1.1.3 that expose endpoints accepting user-controlled filter parameters for Redis vector store queries.
2. Identify injection point: Locate API endpoints or application inputs that pass user-supplied strings as TAG field filter values to the RedisFilterExpressionConverter.stringValue() method.
3. Craft malicious payload: Construct a filter value containing RediSearch special characters (e.g., }|@otherfield:{*) designed to break out of the intended @field:{VALUE} TAG block and inject additional query clauses.
4. Submit injected query: Send the crafted input via the application's normal request mechanism (e.g., HTTP request with a search/filter parameter). The unescaped value is inserted directly into the RediSearch query.
5. Exfiltrate data: The manipulated query bypasses intended access controls, returning data records from the Redis store that the attacker should not be authorized to access (Spring Advisory, Feedly).

• Network: Unusual or malformed filter query parameters in HTTP requests to application endpoints that interface with Redis vector stores; parameters containing RediSearch special characters such as }, |, {, *, or @ in filter value fields.
• Logs: Application logs showing unexpected RediSearch query strings with injected clauses (e.g., @field:{value}|@otherfield:{*}); Redis slow log entries reflecting anomalous or unexpectedly broad TAG filter queries.
• Application Behavior: Unexpectedly large result sets returned from vector store queries; query results containing records outside the expected scope for a given user or session.

Users should upgrade spring-ai-redis-store to the fixed versions: 1.0.5 (for the 1.0.x branch) or 1.1.4 (for the 1.1.x branch). No additional mitigation steps are required after upgrading, per the vendor advisory. As a temporary measure if immediate patching is not feasible, implement server-side input validation to reject or escape RediSearch special characters in TAG filter values before they reach RedisFilterExpressionConverter (Spring Advisory).

The Canadian Centre for Cyber Security (CCCS) issued a security advisory (AV26-288) covering this vulnerability shortly after disclosure (CCCS Advisory). Spain's INCIBE-CERT also published an alert. The vulnerability was credited to researcher Hyunwoo Kim (@V4bel), who reported it responsibly to the Spring team (Spring Advisory). Community coverage has been limited to standard vulnerability tracking platforms, with no significant social media debate or major media coverage observed.