CVE-2026-40980

Memory Exhaustion via Malformed PDF in Spring AI

View on CVE.org
Published Apr 28, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

Analysis

AI-generated

Technical impact

Spring AI can be forced to allocate an unreasonable amount of memory when it processes a maliciously crafted PDF file through the ForkPDFLayoutTextStripper. The excessive memory consumption leads to resource exhaustion, potentially causing the application to become unresponsive or crash. The weakness is a classic example of uncontrolled resource consumption, identified as CWE‑400.

Affected Systems

The affected product is Spring AI. Versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4 are vulnerable; the issue was resolved in Spring AI 1.0.6 and 1.1.5.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate to high severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that public exploitation may be limited. The likely attack vector is the delivery of a specially crafted PDF to a Spring AI instance that processes user‑supplied documents; an attacker could then induce memory exhaustion and potentially deny service to legitimate users.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Spring AI to a fixed release (1.0.6 or 1.1.5).
  • Restrict the size of PDF files accepted by the application and perform strict validation before invoking ForkPDFLayoutTextStripper.
  • Apply application‑level memory quotas or OS‑level resource limits to prevent a single request from consuming excessive memory.

Generated by OpenCVE AI on April 28, 2026 at 19:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-26gg-9gv2-v27j Spring AI Vulnerable to OOM by attacker-controlled PDF
References
Link Providers
https://spring.io/security/cve-2026-40980 cve-icon cve-icon
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Vmware
Vmware spring Ai
CPEs cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*
Vendors & Products Vmware
Vmware spring Ai
Type Values Removed Values Added
First Time appeared Spring
Spring spring
Vendors & Products Spring
Spring spring
Type Values Removed Values Added
Title Memory Exhaustion via Malformed PDF in Spring AI
Type Values Removed Values Added
Description In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}
Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

Sources

Status
PUBLISHED
Assigner
vmware
Published
Updated
Apr 28, 2026, 12:32 PM
Reserved
Apr 16, 2026, 2:19 AM

View source JSON

Updated
Apr 28, 2026, 12:32 PM

JSON

Status
Analyzed
Published
Apr 28, 2026, 9:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 29, 2026, 10:00 AM

JSON