Medium severity6.5NVD Advisory· Published Apr 28, 2026· Updated Apr 29, 2026
CVE-2026-40980
CVE-2026-40980
Description
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper.
Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.ai:spring-ai-pdf-document-readerMaven | >= 1.0.0, < 1.0.6 | 1.0.6 |
org.springframework.ai:spring-ai-pdf-document-readerMaven | >= 1.1.0, < 1.1.5 | 1.1.5 |
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-26gg-9gv2-v27jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-40980ghsaADVISORY
- spring.io/security/cve-2026-40980nvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.