What happened
Spring AI (2.0.0, 1.1.0–1.1.8, 1.0.0–1.0.9) contains CVE-2026-47851, where analyzing a PDF with a deeply nested or cyclic table-of-contents outline tree causes unbounded recursion and a StackOverflowError in the ingestion thread, and CVE-2026-47852, where a local attacker on a multi-user host can pre-create Spring AI's deterministic ONNX model cache path and plant a malicious model file that gets loaded by other users/processes.
Why it matters
Spring AI is a widely used Java framework for building RAG/document-ingestion pipelines; the PDF vulnerability enables a trivial denial-of-service against document-ingestion services, while the ONNX cache-path issue lets a local attacker on shared infrastructure substitute a malicious embedding model that other tenants unknowingly load and execute.
Attack vector
Uploading a crafted PDF with cyclic/deeply nested TOC to trigger stack overflow; or pre-creating a predictable cache file path to plant a malicious ONNX model on a shared host
Affected systems
Spring AI 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0
Mitigation
Upgrade to Spring AI 2.0.1 or later per spring.io/security/cve-2026-47851 and cve-2026-47852