This vulnerability allows an attacker to supply a malicious media URL in a multimodal message, causing the BedrockProxyChatModel to fetch that URL without proper validation. The resulting server‑side request can target internal or external resources, potentially exposing sensitive data or providing a pivot to internal services. The flaw does not directly grant code execution but enables unauthorized network access and data exfiltration.

Spring AI’s spring‑ai‑bedrock‑converse package, versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3, is affected. The issue remains in all releases prior to 1.0.5 and 1.1.4.

The CVSS score of 8.6 marks it as high severity, and the EPSS score is below 1%, indicating low current exploitation probability. The vulnerability is not listed in the KEV catalog, suggesting no publicly confirmed exploits. However, the attack vector—sending a crafted multimodal message—is straightforward for any actor with message‑sending access, making the risk significant for exposed deployments.