PT-2026-35689 · Vmware · Spring Ai

Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-40980

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.5 Spring AI versions 1.1.0 through 1.1.4

Description A malicious PDF file can be crafted to trigger the allocation of unreasonable amounts of memory when processed by the ForkPDFLayoutTextStripper() function, potentially leading to a denial of service.

Recommendations Update to version 1.0.6 for versions 1.0.0 through 1.0.5. Update to version 1.1.5 for versions 1.1.0 through 1.1.4. As a temporary workaround, consider restricting the use of the ForkPDFLayoutTextStripper() function until the update is applied.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-40980

GHSA-26GG-9GV2-V27J

Affected Products

Spring Ai

References · 6

• https://spring.io/security/cve-2026-40980 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26gg-9gv2-v27j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40980 · Security Note
• https://github.com/spring-projects/spring-ai · Note
• https://t.me/cveNotify/161225 · Telegram Post
• https://t.me/CVEtracker/52046 · Telegram Post