Spring AI does not separate cached responses for different system prompts as strictly as intended. The context hash, which is used to isolate cached replies, truncates a SHA‑256 value, creating the possibility that two unrelated prompts produce identical hashes. Because of this collision, a requester can retrieve a cached answer that was generated for a different context, exposing information that should have been isolated to the original tenant.

Products affected are Spring AI version 2.0.0.

The CVSS score of 4.2 reflects a moderate risk. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The attack vector is inferred to involve normal usage of the Semantic Cache feature, which allows collision exploitation if an attacker can trigger identical truncated hashes for different tenant contexts.