CVE-2026-40980

published 2026-04-28

CVE-2026-40980: In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`…

Priority P4 34 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

Affected

4 ranges

Vendor	Product	Version range	Fixed in
spring	spring_ai	>= 1.0.0 < 1.0.6	1.0.6
spring	spring_ai	>= 1.1.0 < 1.1.5	1.1.5
vmware	spring_ai	>= 1.0.0 < 1.0.6	1.0.6
vmware	spring_ai	>= 1.1.0 < 1.1.5	1.1.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-400