Skip to content
OpenAdvisories
High · 7.5 CVE-2026-47851 EUVD-2026-66821GHSA-3934-8pqh-qq29

Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

Published Aug 26, 2026 · Updated Aug 27, 2026 · Assigned by vmware

Description

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.
Spring AI 2.0.0
Spring AI 1.1.0 - 1.1.8
Spring AI 1.0.0 - 1.0.9

Affected products

VendorProductAffectedFixed
Spring Spring AI 2.0.0, 1.1.0 – ≤ 1.1.8, 1.0.0 – ≤ 1.0.9 —

References