CVE-2026-47851 — Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

CVE-2026-47851

Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader PUBLISHED

Description (CNA)

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9

Affected (CNA)

Vendor / product	Versions
Spring / Spring AI	affected 2.0.0; affected 1.1.0 through 1.1.8; affected 1.0.0 through 1.0.9

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47851

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.