{"id":"CVE-2026-47851","aliases":["CLSA-2026-1793463667","CLSA-2026-1793654179","EUVD-2026-66821","GHSA-3934-8pqh-qq29"],"status":"published","title":"Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader","description":"Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0046,"percentile":0.40318,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-674"],"published":"2026-08-26T23:28:41Z","modified":"2026-11-03T02:45:02Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.9-tuxcare.1"}]}],"versions":["1.0.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-pdf-document-reader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.9-tuxcare.1"}]}],"versions":["1.0.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-transformers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.9-tuxcare.1"}]}],"versions":["1.0.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8"},{"fixed":"1.1.8-tuxcare.1"}]}],"versions":["1.1.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-pdf-document-reader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8"},{"fixed":"1.1.8-tuxcare.1"}]}],"versions":["1.1.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-transformers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8"},{"fixed":"1.1.8-tuxcare.1"}]}],"versions":["1.1.8"],"bundled":4}],"products":[{"vendor":"spring","product":"spring ai"},{"vendor":"vmware","product":"spring ai"},{"vendor":"vmware","product":"spring_ai"}],"references":[{"url":"https://spring.io/security/cve-2026-47851","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47851","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3934-8pqh-qq29"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47851.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47851","title":"Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader","description":"Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-26T23:28:41.732Z","modified":"2026-08-27T15:14:42.087Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66821","description":"Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-26T23:28:41Z","modified":"2026-08-27T15:14:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:27.663452Z"}],"ghsa":[{"id":"GHSA-3934-8pqh-qq29","title":"Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError...","description":"Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-27T03:32:58Z","modified":"2026-08-27T18:32:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:11:03.315113Z"}],"nvd":[{"id":"CVE-2026-47851","description":"Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-27T01:17:32.15Z","modified":"2026-09-04T20:08:06.56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-47851","title":"Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader","description":"Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-26T23:28:41.732Z","modified":"2026-10-28T02:30:39.223753276Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"CLSA-2026-1793463667","title":"TuxCare security update for org.springframework.ai (4 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ai packages to address 4 CVEs. Fixed in 1.0.9-tuxcare.1.","status":"published","published":"2026-10-31T17:21:08Z","modified":"2026-11-02T19:46:33.281908979Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793654179","title":"TuxCare security update for org.springframework.ai (4 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ai packages to address 4 CVEs. Fixed in 1.1.8-tuxcare.1.","status":"published","published":"2026-11-02T22:16:19Z","modified":"2026-11-03T02:45:02.358314545Z","updated_at":"2026-11-03T03:05:43.703218Z"}]}}