{"id":"CVE-2026-55405","summary":"LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector","details":"LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to  1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.","aliases":["GHSA-2mfg-cc43-9pcj"],"modified":"2026-08-12T16:41:19.250396Z","published":"2026-07-10T20:33:40.804Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"1.2.1-beta8"},{"introduced":"1.3.0-beta9"},{"fixed":"1.5.1-beta11"},{"introduced":"1.6.0-beta12"},{"fixed":"1.11.8-beta19"},{"introduced":"1.12.1-beta21"},{"fixed":"1.16.3-beta26"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55405.json"},"references":[{"type":"WEB","url":"https://github.com/langchain4j/langchain4j/releases/tag/1.16.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55405.json"},{"type":"ADVISORY","url":"https://github.com/langchain4j/langchain4j/security/advisories/GHSA-2mfg-cc43-9pcj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55405"},{"type":"FIX","url":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219"},{"type":"FIX","url":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf"},{"type":"FIX","url":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7"},{"type":"FIX","url":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f"},{"type":"FIX","url":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/langchain4j/langchain4j","events":[{"introduced":"0"},{"fixed":"13a0698bdfaf105d8aaf0367881df51358596219"},{"fixed":"1bc1f60aa58ef5c3c1703caf73362482480351cf"},{"fixed":"8805d5d128694302f1b0a2650174186862f669e7"},{"fixed":"ce96291dfb243c7f6753b5d65c7a77914642314f"},{"fixed":"f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2"},{"fixed":"9d458d1b4d8b78c4b6c3dfbd7b1306c14add1547"}],"database_specific":{"source":"REFERENCES"}}],"versions":["1.5.0","1.2.0","1.11.7","1.16.2","1.16.1","1.16.0","1.15.0","1.11.6","1.14.0","1.13.0","1.11.4","1.11.0","1.0.0-beta2","1.0.0-beta1","1.0.0-alpha1","0.36.2","0.36.1","0.36.0","0.35.0","0.34.0","0.33.0","0.32.0","0.31.0","0.30.0","0.29.1","0.29.0","0.28.0","0.27.1","0.27.0","0.26.1","0.26.0","0.25.0","0.24.0","0.23.0","0.22.0","0.21.0","0.20.0","0.19.0","0.18.0","0.17.0","0.16.0","0.15.0","0.14.0","0.13.0","0.12.0","0.11.0","0.10.0","0.9.0","0.8.0","0.7.0","0.6.0","0.5.0","0.4.0","0.3.0","0.2.0","0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55405.json","vanir_signatures_modified":"2026-08-12T16:41:19Z","vanir_signatures":[{"id":"CVE-2026-55405-0b30863e","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"function":"formatKeyAsString","file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java"},"deprecated":false,"digest":{"function_hash":"22309746664509163683096419757802447802","length":81}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"length":130,"function_hash":"200734607670113622346789669909784155665"},"id":"CVE-2026-55405-0bf820a2"},{"source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["233081021066593100042159979582552462055","319931484931082249906960054766834952697","243314915878534714371823596717343283561","55241339869933153804413556941518884823","141773591913636622828902868486246656114","177820502528866482579326546962572952096"],"threshold":0.9},"id":"CVE-2026-55405-0e048186","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-mariadb/src/test/java/dev/langchain4j/store/embedding/mariadb/MariaDbEmbeddingStoreConfigIT.java"},"deprecated":false,"digest":{"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","334368975180077633754324339080630719453","316081024571595715949880007088229717764","265097305255915522976756975437836459846","178884434173164098152636961069851097777","87985120590550312759673250638413859023"],"threshold":0.9},"id":"CVE-2026-55405-0f449423"},{"id":"CVE-2026-55405-0fb999b4","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["271508897104286288506593735110739469848","50986615052821982139595972276044543382","250868750879556785404835319455458863492","71155136843021950071917823817669216414","192179141613653252602963230029595884473","280741302164137606681651535516871433413"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKeyAsString"},"deprecated":false,"digest":{"length":49,"function_hash":"247812204483236988560659050437122045705"},"id":"CVE-2026-55405-152d39a5"},{"digest":{"line_hashes":["16940693500464973292909230123457521841","13729314999100993280957949160392027903","211875769060369048190249039336811456924","54420365495136016944618094933974495355","163393768954370472169487563158265107803"],"threshold":0.9},"id":"CVE-2026-55405-1587bdf8","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorFilterMapperTest.java"},"deprecated":false},{"target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"function_hash":"232983840488775149885209847009817149310","length":106},"id":"CVE-2026-55405-173b6f34","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf"},{"target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["216609758934408459633685963409015461675","333503859255000896224030186531672513131","90434904747797583093238832373931352912","241427830647907768291343489331307874410","44708192222248574376806742962839406126","10971632503836409477852967464412594296","176946691060226020480459226356238317121","76700218691627715732153916182452808982","206263621928933194579987968658315645447"],"threshold":0.9},"id":"CVE-2026-55405-18306e78","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7"},{"digest":{"function_hash":"200734607670113622346789669909784155665","length":130},"id":"CVE-2026-55405-1be05ca1","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"function":"formatKey","file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["271508897104286288506593735110739469848","50986615052821982139595972276044543382","250868750879556785404835319455458863492","71155136843021950071917823817669216414","192179141613653252602963230029595884473","280741302164137606681651535516871433413"],"threshold":0.9},"id":"CVE-2026-55405-22d6acc2","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["159461226107712741483315858829002440550","71049399867253116779684466962091945754","154599429857754695457059624363771062176","320073647773706946282640098136577631151"],"threshold":0.9},"id":"CVE-2026-55405-2496ced9"},{"source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-mariadb/src/test/java/dev/langchain4j/store/embedding/mariadb/MariaDbEmbeddingStoreConfigIT.java"},"deprecated":false,"digest":{"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","334368975180077633754324339080630719453","316081024571595715949880007088229717764","265097305255915522976756975437836459846","178884434173164098152636961069851097777","87985120590550312759673250638413859023"],"threshold":0.9},"id":"CVE-2026-55405-25487f8a","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-55405-258d916f","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorFilterMapperTest.java"},"deprecated":false,"digest":{"line_hashes":["16940693500464973292909230123457521841","13729314999100993280957949160392027903","211875769060369048190249039336811456924","54420365495136016944618094933974495355","163393768954370472169487563158265107803"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorEmbeddingStoreConfigIT.java"},"deprecated":false,"digest":{"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","160292563850690774777364824340095892808","229592516734611277519286644710823570946","263282474941298274079132100289500677926","178884434173164098152636961069851097777","87985120590550312759673250638413859023"],"threshold":0.9},"id":"CVE-2026-55405-25fbbb13","signature_type":"Line"},{"id":"CVE-2026-55405-289a9921","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["159461226107712741483315858829002440550","71049399867253116779684466962091945754","154599429857754695457059624363771062176","320073647773706946282640098136577631151"],"threshold":0.9}},{"digest":{"length":157,"function_hash":"84398955226373777745553597226648420585"},"id":"CVE-2026-55405-28cdd509","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java","function":"formatKey"},"deprecated":false},{"digest":{"function_hash":"232983840488775149885209847009817149310","length":106},"id":"CVE-2026-55405-2d16c9d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java","function":"formatKey"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["271508897104286288506593735110739469848","50986615052821982139595972276044543382","250868750879556785404835319455458863492","71155136843021950071917823817669216414","192179141613653252602963230029595884473","280741302164137606681651535516871433413"],"threshold":0.9},"id":"CVE-2026-55405-308aa04e","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"232983840488775149885209847009817149310","length":106},"id":"CVE-2026-55405-3778d426","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java","function":"formatKey"}},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["159461226107712741483315858829002440550","71049399867253116779684466962091945754","154599429857754695457059624363771062176","320073647773706946282640098136577631151"],"threshold":0.9},"id":"CVE-2026-55405-3b12ed7a","signature_type":"Line"},{"id":"CVE-2026-55405-3dc7f091","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java","function":"formatKeyAsString"},"deprecated":false,"digest":{"function_hash":"22309746664509163683096419757802447802","length":81}},{"id":"CVE-2026-55405-3efdb826","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKeyAsString"},"deprecated":false,"digest":{"function_hash":"247812204483236988560659050437122045705","length":49}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["216609758934408459633685963409015461675","333503859255000896224030186531672513131","90434904747797583093238832373931352912","241427830647907768291343489331307874410","44708192222248574376806742962839406126","10971632503836409477852967464412594296","176946691060226020480459226356238317121","76700218691627715732153916182452808982","206263621928933194579987968658315645447"],"threshold":0.9},"id":"CVE-2026-55405-404a8ba0"},{"id":"CVE-2026-55405-416d41c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKeyAsString"},"deprecated":false,"digest":{"function_hash":"247812204483236988560659050437122045705","length":49}},{"deprecated":false,"digest":{"function_hash":"280359000273655964287087915004167480986","length":436},"id":"CVE-2026-55405-4c3f666a","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java","function":"formatValue"}},{"deprecated":false,"digest":{"function_hash":"255072566328297803836744698907777341329","length":131},"id":"CVE-2026-55405-542ea2cc","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKey"}},{"deprecated":false,"digest":{"function_hash":"255072566328297803836744698907777341329","length":131},"id":"CVE-2026-55405-5c5e46eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKey"}},{"id":"CVE-2026-55405-5f447e93","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"function_hash":"84398955226373777745553597226648420585","length":157}},{"deprecated":false,"digest":{"function_hash":"200734607670113622346789669909784155665","length":130},"id":"CVE-2026-55405-60e5cbf2","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java","function":"formatKey"}},{"target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java","function":"formatKeyAsString"},"deprecated":false,"digest":{"function_hash":"22309746664509163683096419757802447802","length":81},"id":"CVE-2026-55405-64331652","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2"},{"source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["233081021066593100042159979582552462055","319931484931082249906960054766834952697","243314915878534714371823596717343283561","55241339869933153804413556941518884823","141773591913636622828902868486246656114","177820502528866482579326546962572952096"],"threshold":0.9},"id":"CVE-2026-55405-656ebf30","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["241077003649890885680644431247306692465","221771504450806584962441327316264107597","65373640162066032384918626605773435335"],"threshold":0.9},"id":"CVE-2026-55405-66f2e807","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["159461226107712741483315858829002440550","71049399867253116779684466962091945754","154599429857754695457059624363771062176","320073647773706946282640098136577631151"],"threshold":0.9},"id":"CVE-2026-55405-6858328f"},{"digest":{"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","334368975180077633754324339080630719453","316081024571595715949880007088229717764","265097305255915522976756975437836459846","178884434173164098152636961069851097777","87985120590550312759673250638413859023"],"threshold":0.9},"id":"CVE-2026-55405-696d75cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-mariadb/src/test/java/dev/langchain4j/store/embedding/mariadb/MariaDbEmbeddingStoreConfigIT.java"},"deprecated":false},{"target":{"function":"formatKey","file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java"},"deprecated":false,"digest":{"function_hash":"84398955226373777745553597226648420585","length":157},"id":"CVE-2026-55405-6aaa627b","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219"},{"source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"function":"formatValue","file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java"},"deprecated":false,"digest":{"length":436,"function_hash":"280359000273655964287087915004167480986"},"id":"CVE-2026-55405-77d419f0","signature_type":"Function","signature_version":"v1"},{"target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorEmbeddingStoreConfigIT.java"},"deprecated":false,"digest":{"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","160292563850690774777364824340095892808","229592516734611277519286644710823570946","263282474941298274079132100289500677926","178884434173164098152636961069851097777","87985120590550312759673250638413859023"],"threshold":0.9},"id":"CVE-2026-55405-7b4fc200","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf"},{"id":"CVE-2026-55405-7e29c2b8","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["233081021066593100042159979582552462055","319931484931082249906960054766834952697","243314915878534714371823596717343283561","55241339869933153804413556941518884823","141773591913636622828902868486246656114","177820502528866482579326546962572952096"],"threshold":0.9}},{"id":"CVE-2026-55405-7f877ce9","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKeyAsString"},"deprecated":false,"digest":{"function_hash":"247812204483236988560659050437122045705","length":49}},{"target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"function_hash":"255072566328297803836744698907777341329","length":131},"id":"CVE-2026-55405-83ae7fc8","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7"},{"id":"CVE-2026-55405-87e4d6e9","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["271508897104286288506593735110739469848","50986615052821982139595972276044543382","250868750879556785404835319455458863492","71155136843021950071917823817669216414","192179141613653252602963230029595884473","280741302164137606681651535516871433413"],"threshold":0.9}},{"source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"function_hash":"232983840488775149885209847009817149310","length":106},"id":"CVE-2026-55405-97dcc796","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["241077003649890885680644431247306692465","221771504450806584962441327316264107597","65373640162066032384918626605773435335"],"threshold":0.9},"id":"CVE-2026-55405-9945cac0","signature_type":"Line"},{"digest":{"line_hashes":["216609758934408459633685963409015461675","333503859255000896224030186531672513131","90434904747797583093238832373931352912","241427830647907768291343489331307874410","44708192222248574376806742962839406126","10971632503836409477852967464412594296","176946691060226020480459226356238317121","76700218691627715732153916182452808982","206263621928933194579987968658315645447"],"threshold":0.9},"id":"CVE-2026-55405-996f248c","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["233081021066593100042159979582552462055","319931484931082249906960054766834952697","243314915878534714371823596717343283561","55241339869933153804413556941518884823","141773591913636622828902868486246656114","177820502528866482579326546962572952096"],"threshold":0.9},"id":"CVE-2026-55405-9a117e46","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java"}},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["233081021066593100042159979582552462055","319931484931082249906960054766834952697","243314915878534714371823596717343283561","55241339869933153804413556941518884823","141773591913636622828902868486246656114","177820502528866482579326546962572952096"],"threshold":0.9},"id":"CVE-2026-55405-9b272858","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["241077003649890885680644431247306692465","221771504450806584962441327316264107597","65373640162066032384918626605773435335"],"threshold":0.9},"id":"CVE-2026-55405-9c928134","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java"}},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorFilterMapperTest.java"},"deprecated":false,"digest":{"line_hashes":["16940693500464973292909230123457521841","13729314999100993280957949160392027903","211875769060369048190249039336811456924","54420365495136016944618094933974495355","163393768954370472169487563158265107803"],"threshold":0.9},"id":"CVE-2026-55405-9ce62de7","signature_type":"Line"},{"id":"CVE-2026-55405-a1b7c94e","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java","function":"formatKeyAsString"},"deprecated":false,"digest":{"function_hash":"22309746664509163683096419757802447802","length":81}},{"deprecated":false,"digest":{"function_hash":"232983840488775149885209847009817149310","length":106},"id":"CVE-2026-55405-a4d03643","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java","function":"formatKey"}},{"id":"CVE-2026-55405-acf9b7a2","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorEmbeddingStoreConfigIT.java"},"deprecated":false,"digest":{"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","160292563850690774777364824340095892808","229592516734611277519286644710823570946","263282474941298274079132100289500677926","178884434173164098152636961069851097777","87985120590550312759673250638413859023"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"200734607670113622346789669909784155665","length":130},"id":"CVE-2026-55405-b112a04b","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java","function":"formatKey"}},{"target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["216609758934408459633685963409015461675","333503859255000896224030186531672513131","90434904747797583093238832373931352912","241427830647907768291343489331307874410","44708192222248574376806742962839406126","10971632503836409477852967464412594296","176946691060226020480459226356238317121","76700218691627715732153916182452808982","206263621928933194579987968658315645447"],"threshold":0.9},"id":"CVE-2026-55405-b616c2b6","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219"},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorEmbeddingStoreConfigIT.java"},"deprecated":false,"digest":{"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","160292563850690774777364824340095892808","229592516734611277519286644710823570946","263282474941298274079132100289500677926","178884434173164098152636961069851097777","87985120590550312759673250638413859023"],"threshold":0.9},"id":"CVE-2026-55405-b7949a26","signature_type":"Line"},{"source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"function":"formatKeyAsString","file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java"},"deprecated":false,"digest":{"length":81,"function_hash":"22309746664509163683096419757802447802"},"id":"CVE-2026-55405-ba06d3d1","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-55405-bc84a9fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorFilterMapperTest.java"},"deprecated":false,"digest":{"line_hashes":["16940693500464973292909230123457521841","13729314999100993280957949160392027903","211875769060369048190249039336811456924","54420365495136016944618094933974495355","163393768954370472169487563158265107803"],"threshold":0.9}},{"source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java","function":"formatValue"},"deprecated":false,"digest":{"function_hash":"280359000273655964287087915004167480986","length":436},"id":"CVE-2026-55405-c13766a5","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"247812204483236988560659050437122045705","length":49},"id":"CVE-2026-55405-c561d40a","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKeyAsString"},"deprecated":false},{"source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["241077003649890885680644431247306692465","221771504450806584962441327316264107597","65373640162066032384918626605773435335"],"threshold":0.9},"id":"CVE-2026-55405-d6cc6002","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["159461226107712741483315858829002440550","71049399867253116779684466962091945754","154599429857754695457059624363771062176","320073647773706946282640098136577631151"],"threshold":0.9},"id":"CVE-2026-55405-d84bc5a1"},{"source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java","function":"formatValue"},"deprecated":false,"digest":{"function_hash":"280359000273655964287087915004167480986","length":436},"id":"CVE-2026-55405-db2a7699","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-55405-db618d8a","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["271508897104286288506593735110739469848","50986615052821982139595972276044543382","250868750879556785404835319455458863492","71155136843021950071917823817669216414","192179141613653252602963230029595884473","280741302164137606681651535516871433413"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"function_hash":"84398955226373777745553597226648420585","length":157},"id":"CVE-2026-55405-dfc291fb","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/JSONFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"function_hash":"84398955226373777745553597226648420585","length":157},"id":"CVE-2026-55405-e0e07c40","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-mariadb/src/test/java/dev/langchain4j/store/embedding/mariadb/MariaDbEmbeddingStoreConfigIT.java"},"deprecated":false,"digest":{"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","334368975180077633754324339080630719453","316081024571595715949880007088229717764","265097305255915522976756975437836459846","178884434173164098152636961069851097777","87985120590550312759673250638413859023"],"threshold":0.9},"id":"CVE-2026-55405-e6b7d675"},{"source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/JSONFilterMapper.java"},"deprecated":false,"digest":{"line_hashes":["241077003649890885680644431247306692465","221771504450806584962441327316264107597","65373640162066032384918626605773435335"],"threshold":0.9},"id":"CVE-2026-55405-ec45b499","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"function_hash":"255072566328297803836744698907777341329","length":131},"id":"CVE-2026-55405-ef9c1885","signature_type":"Function","signature_version":"v1"},{"target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorEmbeddingStoreConfigIT.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","160292563850690774777364824340095892808","229592516734611277519286644710823570946","263282474941298274079132100289500677926","178884434173164098152636961069851097777","87985120590550312759673250638413859023"]},"id":"CVE-2026-55405-efacf85d","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219"},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","target":{"file":"langchain4j-pgvector/src/test/java/dev/langchain4j/store/embedding/pgvector/PgVectorFilterMapperTest.java"},"deprecated":false,"digest":{"line_hashes":["16940693500464973292909230123457521841","13729314999100993280957949160392027903","211875769060369048190249039336811456924","54420365495136016944618094933974495355","163393768954370472169487563158265107803"],"threshold":0.9},"id":"CVE-2026-55405-efaebab2","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["216609758934408459633685963409015461675","333503859255000896224030186531672513131","90434904747797583093238832373931352912","241427830647907768291343489331307874410","44708192222248574376806742962839406126","10971632503836409477852967464412594296","176946691060226020480459226356238317121","76700218691627715732153916182452808982","206263621928933194579987968658315645447"],"threshold":0.9},"id":"CVE-2026-55405-f1a09bb0","signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java"}},{"deprecated":false,"digest":{"function_hash":"280359000273655964287087915004167480986","length":436},"id":"CVE-2026-55405-f2479405","signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/MariaDbFilterMapper.java","function":"formatValue"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","target":{"file":"langchain4j-mariadb/src/main/java/dev/langchain4j/store/embedding/mariadb/ColumnFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"function_hash":"200734607670113622346789669909784155665","length":130},"id":"CVE-2026-55405-f4b17318"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","target":{"file":"langchain4j-mariadb/src/test/java/dev/langchain4j/store/embedding/mariadb/MariaDbEmbeddingStoreConfigIT.java"},"deprecated":false,"digest":{"line_hashes":["77668480240539167135122855738941060033","212646489725985672416161060751355593162","193974661435568646012302983943896746157","144945546872294789639185764495825823776","125338613591654412094984884377139966477","54039244503978722101735322048197561517","334368975180077633754324339080630719453","316081024571595715949880007088229717764","265097305255915522976756975437836459846","178884434173164098152636961069851097777","87985120590550312759673250638413859023"],"threshold":0.9},"id":"CVE-2026-55405-fa7034f3"},{"signature_version":"v1","source":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","target":{"file":"langchain4j-pgvector/src/main/java/dev/langchain4j/store/embedding/pgvector/ColumnFilterMapper.java","function":"formatKey"},"deprecated":false,"digest":{"function_hash":"255072566328297803836744698907777341329","length":131},"id":"CVE-2026-55405-fe632f78","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"}]}