CVE-2026-47851: Spring AI Denial of Service Vulnerability

CVE-2026-47851 Overview

CVE-2026-47851 is a denial-of-service vulnerability in Spring AI's PDF ingestion pipeline. Analyzing a PDF with a deeply nested or cyclic table of contents triggers a StackOverflowError in the ingestion thread. The flaw affects Spring AI 2.0.0, Spring AI 1.1.0 through 1.1.8, and Spring AI 1.0.0 through 1.0.9. An unauthenticated attacker can supply a malicious PDF over the network to exhaust stack resources and disrupt ingestion workloads. The vulnerability has no confidentiality or integrity impact but produces high availability impact.

Critical Impact
A single crafted PDF can crash the Spring AI ingestion thread, disrupting document indexing pipelines used by retrieval-augmented generation (RAG) workloads.

Affected Products

Spring AI 2.0.0
Spring AI 1.1.0 through 1.1.8
Spring AI 1.0.0 through 1.0.9

Discovery Timeline

2026-08-27 - CVE-2026-47851 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47851

Vulnerability Analysis

Spring AI provides document readers that parse PDF files during ingestion into vector stores. The PDF reader walks the document outline, also known as the table of contents, to preserve structural metadata for downstream chunking. The traversal implementation recurses into each outline node without enforcing a depth limit or detecting cycles.

When the reader processes a PDF whose outline tree is deeply nested or contains cyclic references between outline entries, recursion continues until the Java Virtual Machine (JVM) exhausts thread stack space. The result is an uncaught StackOverflowError that terminates the ingestion thread and halts document processing.

The attack requires no authentication and no user interaction beyond submitting a document to an ingestion endpoint. Applications that accept PDFs from untrusted users, such as chatbots, knowledge-base loaders, and RAG pipelines, are directly exposed.

Root Cause

The root cause is unbounded recursion during PDF outline traversal combined with missing cycle detection. The parser trusts the structure supplied by the PDF and does not cap traversal depth or track visited outline nodes. This is an algorithmic-complexity and resource-exhaustion condition classified as a denial-of-service weakness.

Attack Vector

An attacker crafts a PDF whose outline contains either a very deep hierarchy of nested entries or two outline nodes that reference each other to form a cycle. The attacker uploads or submits the PDF to any Spring AI ingestion endpoint. When the reader parses the outline, the recursive traversal overflows the stack and throws StackOverflowError, aborting ingestion. Repeated submission sustains the denial of service.

No verified exploit code is published. Refer to the Spring Security Advisory CVE-2026-47851 for vendor technical details.

Detection Methods for CVE-2026-47851

Indicators of Compromise

StackOverflowError stack traces originating from Spring AI PDF reader classes in application logs
Ingestion worker threads terminating unexpectedly while processing user-supplied PDFs
Repeated PDF upload attempts from a single source followed by ingestion service errors
Abnormally large or structurally unusual PDF outline sections in submitted documents

Detection Strategies

Parse application logs for java.lang.StackOverflowError events tied to Spring AI ingestion components
Alert on ingestion job failure spikes correlated with specific document uploads or tenants
Inspect submitted PDFs for outline trees exceeding a sane depth threshold or containing self-referential entries before parsing

Monitoring Recommendations

Track ingestion thread crash rates and JVM error counters for the Spring AI service
Monitor upload endpoints for unusually small PDFs that produce disproportionate parsing time or crashes
Correlate authentication and upload telemetry to identify sources repeatedly submitting malformed PDFs

How to Mitigate CVE-2026-47851

Immediate Actions Required

Upgrade Spring AI to a fixed release as listed in the Spring Security Advisory CVE-2026-47851
Restrict PDF ingestion endpoints to authenticated, trusted users until patching is complete
Add a pre-ingestion validation step that rejects PDFs with excessive outline depth or cyclic references
Run PDF ingestion workers in isolated processes so a StackOverflowError cannot destabilize the wider application

Patch Information

Spring publishes fixed versions and technical details in the Spring Security Advisory CVE-2026-47851. Update all deployments on Spring AI 2.0.0, 1.1.0-1.1.8, or 1.0.0-1.0.9 to the vendor-supplied patched releases.

Workarounds

Disable PDF ingestion for untrusted sources until patches are applied
Pre-flight PDFs with a hardened parser that enforces outline depth limits and detects cycles before handing files to Spring AI
Constrain ingestion worker thread stack size and container CPU quotas to limit blast radius from crashed threads

bash

# Configuration example
# Enforce authentication and size limits on the PDF ingestion endpoint
# Example Spring Boot properties
spring.servlet.multipart.max-file-size=5MB
spring.servlet.multipart.max-request-size=5MB
management.endpoints.web.exposure.include=health,info