What is the CVSS score of CVE-2026-40980?

CVE-2026-40980 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40980?

Yes, a patch is available for CVE-2026-40980. Update the affected software to the latest version immediately.

Spring AI CVE-2026-40980

EUVD-2026-26013 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-28 security@vmware.com

Java Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 29, 2026 - 18:15 nvd

Patch available

Apr 28, 2026 - 10:01 EUVD

Analysis Generated

Apr 28, 2026 - 09:31 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 09:22 euvd

EUVD-2026-26013

Analysis Generated

Apr 28, 2026 - 09:22 vuln.today

CVE Published

Apr 28, 2026 - 09:16 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 maven packages depend on org.springframework.ai:spring-ai-pdf-document-reader (2 direct, 3 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionCVE.org

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper.

Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

AnalysisAI

Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4 are vulnerable to denial of service through uncontrolled resource consumption when processing maliciously crafted PDF files via the ForkPDFLayoutTextStripper component. Authenticated remote attackers can exhaust server memory and crash affected applications by uploading or processing specially designed PDFs. Vendor-released patches address the issue in versions 1.0.6 and 1.1.5.

Technical ContextAI

Spring AI is a Java-based framework for building AI-powered applications. The vulnerability exists in the PDF text extraction functionality, specifically in the ForkPDFLayoutTextStripper class which handles PDF parsing and text extraction. The root cause is improper validation of PDF structures that can trigger excessive memory allocation during processing (CWE-400: Uncontrolled Resource Consumption). When a malicious PDF is submitted for processing, the stripper fails to enforce reasonable limits on memory allocation, allowing crafted payloads to exhaust available heap memory and cause denial of service.

RemediationAI

Upgrade Spring AI to version 1.0.6 (for 1.0.x users) or version 1.1.5 (for 1.1.x users) immediately per vendor advisory at https://spring.io/security/cve-2026-40980. If immediate upgrade is not feasible, implement application-level controls: restrict PDF upload/submission to authenticated users only (already required by CVSS), enforce strict file size limits on uploaded PDFs (e.g., max 10 MB), implement timeouts on PDF processing operations to prevent indefinite resource consumption, and consider disabling PDF text extraction features if not essential to business logic. Monitor application memory usage and set heap memory alarms to detect exploitation attempts. These controls mitigate but do not eliminate risk - patching is the primary remediation.