GHSA-26gg-9gv2-v27j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-26gg-9gv2-v27j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-26gg-9gv2-v27j/GHSA-26gg-9gv2-v27j.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-26gg-9gv2-v27j
- Aliases
- Published
- 2026-04-28T09:34:13Z
- Modified
- 2026-05-06T20:11:26Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Spring AI Vulnerable to OOM by attacker-controlled PDF
- Details
-
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by
ForkPDFLayoutTextStripper.Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
- Database specific
{ "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2026-05-06T19:51:54Z", "nvd_published_at": "2026-04-28T09:16:16Z", "severity": "MODERATE" }- References
Affected packages
Maven
org.springframework.ai:spring-ai-pdf-document-reader
Package
- Name
- org.springframework.ai:spring-ai-pdf-document-reader
- View open source insights on deps.dev
- Purl
- pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader
org.springframework.ai:spring-ai-pdf-document-reader
Package
- Name
- org.springframework.ai:spring-ai-pdf-document-reader
- View open source insights on deps.dev
- Purl
- pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader