CVE-2026-47851

Analyzed Analyzed - Analysis Complete

StackOverflowError in Spring AI PDF Ingestion

Publication date: 2026-08-27

Last updated on: 2026-09-04

Assigner: VMware

Description

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-04

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47851

EUVD

EUVD-2026-66821

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_ai	From 1.0.0 (inc) to 1.0.10 (exc)
vmware	spring_ai	From 1.1.0 (inc) to 1.1.9 (exc)
vmware	spring_ai	From 2.0.0 (inc) to 2.0.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is in Spring AI PDF Document Reader where analyzing a PDF with a deeply nested or cyclic table of contents causes unbounded recursion, leading to a StackOverflowError in the ingestion thread.

Detection Guidance

Detecting this vulnerability requires checking the version of Spring AI in use. Commands like 'find . -name "spring-ai*.jar" | xargs ls -l' or checking dependency files (e.g., pom.xml, build.gradle) for Spring AI versions 1.0.0-1.0.9, 1.1.0-1.1.8, or 2.0.0 can help identify affected installations.

Impact Analysis

The vulnerability can cause a denial of service by crashing the application due to a StackOverflowError when processing maliciously crafted PDFs. This impacts availability of the system.

Compliance Impact

This vulnerability primarily causes a StackOverflowError in the ingestion thread when processing maliciously crafted PDFs with deeply nested or cyclic table of contents. It does not directly impact data confidentiality or integrity but may lead to service unavailability due to crashes. Compliance impact would be indirect, as prolonged downtime could affect data processing timelines required by GDPR or HIPAA.

Mitigation Strategies

Upgrade to fixed versions: 2.0.1 (OSS), 2.0.0.1 (Enterprise), 1.1.9 (Enterprise), or 1.0.10 (Enterprise). No additional mitigation steps are required beyond updating.

Hi! I’m here to help you understand CVE-2026-47851. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70