Spring AI can be forced to allocate an unreasonable amount of memory when it processes a maliciously crafted PDF file through the ForkPDFLayoutTextStripper. The excessive memory consumption leads to resource exhaustion, potentially causing the application to become unresponsive or crash. The weakness is a classic example of uncontrolled resource consumption, identified as CWE‑400.

The affected product is Spring AI. Versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4 are vulnerable; the issue was resolved in Spring AI 1.0.6 and 1.1.5.

The CVSS score of 6.5 indicates moderate to high severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that public exploitation may be limited. The likely attack vector is the delivery of a specially crafted PDF to a Spring AI instance that processes user‑supplied documents; an attacker could then induce memory exhaustion and potentially deny service to legitimate users.