Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreCVE-2026-40980: OOM by attacker-controlled PDF
Description
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper.
Only applications that use ForkPDFLayoutTextStripper and pass user-supplied input to DocumentReaders are affected.
Affected Spring Products and Versions
Spring AI:
- 1.0.0 - 1.0.x
- 1.1.0 - 1.1.x
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 1.0.x | 1.0.6 | OSS |
| 1.1.x | 1.1.5 | OSS |
No further mitigation steps are necessary.
References
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all