Spring AI: a PDF can exhaust the stack while a local attacker substitutes an ONNX model
CVE-2026-47851 and CVE-2026-47852 affect document ingestion and model caching. Analysis of RAG availability, artifact integrity and Spring AI fixes.
- AUTHOR
- Karol Rapacz / CEO Breachroad · OSCP · PNPT
- PUBLISHED
- 27 August 2026
- READING TIME
- 18 min read
- TOPIC
- AI Security
Two Spring AI records expose different security boundaries in an AI pipeline: document structure and model provenance. CVE-2026-47851 allows a PDF with a deeply nested or cyclic table of contents to cause a StackOverflowError in an ingestion thread. CVE-2026-47852 allows a local user on a multi-user host to pre-create a predictable cache path and place a substituted ONNX model where the application later expects its own artifact.
Both issues have a CVSS 3.1 score of 7.5 (High) and affect Spring AI 2.0.0, 1.1.0–1.1.8 and 1.0.0–1.0.9. Vendor advisories are dated 20 August, while the CVE records were published at 23:28 UTC on 26 August, which is 27 August in Poland. The open-source fixed release is 2.0.1; Spring also lists fixed 2.0.0.1, 1.1.9 and 1.0.10 releases in Enterprise Support channels.
A PDF is an input graph, not merely text
RAG applications often treat PDF as a container of pages from which text is extracted. The format can also hold complex object trees, references, forms, attachments and an outline representing the table of contents. A parser traverses this structure before chunks and embeddings exist. An attack can therefore occur before the actual AI logic begins.
CVE-2026-47851 concerns unbounded recursion over the outline. A normal table of contents is tree-shaped, but an untrusted document can force extreme depth or a cycle. Every recursive call consumes a JVM stack frame. Once the limit is exhausted, a StackOverflowError terminates the thread processing the document.
CVSS models a network attack requiring no privileges or interaction, but reachability depends on the application. The library does not create a public upload endpoint by itself. Exposure exists when a system passes an attacker-controlled PDF to the Spring AI PDF Document Reader: a knowledge-base portal, attachment-ingestion mailbox, crawler or automated document pipeline.
How one thread error can stall a service
Spring describes failure in an ingestion thread. With a separate queue and well-isolated worker, one document may fail one task. In a fragile architecture, the same message returns from the queue, triggers an endless retry loop, occupies every worker and blocks legitimate documents. If parsing happens inside the API process, the error may reduce the available thread pool or cause a restart.
Resilience therefore does not end with patching. The pipeline should cap file size, object count, outline depth, CPU time and retries. A document causing a deterministic failure belongs in a dead-letter queue instead of being processed forever. Parsing can run in a separate process or container with memory limits and without secrets needed only later.
Monitoring should distinguish a bad document from platform failure. Alert on StackOverflowError, repeated failure of the same hash, rising queue age and falling throughput. Hash-based blocking helps with an identical file but does not replace structural limits: many different PDFs can represent the same malicious graph class.
An ONNX cache is part of the pipeline’s trust base
The second issue has different prerequisites. CVE-2026-47852 assumes a local attacker on a multi-user host. Spring AI used a deterministic cache location. If the attacker could create the directory or file before the application process, they could plant an ONNX model that the application later treated as its own artifact.
ONNX is a computational-graph format, not a conventional ELF or JAR executable. Substitution still violates integrity. A model can produce deliberately wrong embeddings, classifications or outputs, consume excessive resources, or reach a separate weakness in the ONNX runtime. The advisory describes model substitution, not confirmed arbitrary code execution; integrity impact should not automatically be relabelled as RCE.
In an embedding pipeline, a substituted model can silently change vector space. New documents are indexed differently from old ones, retrieval quality falls, and results may favour or suppress selected content. In a security classifier, an attacker may try to reduce detection of chosen inputs. This changes system behaviour even when the host is not compromised.
Why a predictable directory name can be unsafe
A cache path may be deterministic when its parent directory has a trusted owner, permissions and an atomic creation process. Risk appears on a shared host when an untrusted user can act before a process with different privileges. This belongs to the pre-creation and symlink-attack family: the application assumes a familiar name identifies its resource, while another actor controlled the namespace.
A safe cache should live under a service-private directory, use restrictive permissions, refuse symlinks and create files atomically. Downloaded models should be pinned to a version and cryptographic digest. Hash verification must occur before the runtime opens the model, with the expected manifest coming from a trust channel separate from the file itself.
Containers do not guarantee protection when workloads share a writable volume or hostPath. Serverless and Kubernetes may reduce local-user risk, but a shared model cache, notebook hub, CI host or laboratory server restores a multi-tenant boundary. Assess effective mounts and UIDs rather than relying on a platform label.
What to upgrade
Spring identifies Spring AI 2.0.1 as the fixed OSS target. Commercially supported lines also have 2.0.0.1, 1.1.9 and 1.0.10. Do not infer the effective release solely from a parent POM or Spring Boot BOM. Inspect resolved Spring AI modules in the dependency tree, SBOM and running artifact.
After upgrading, rebuild images without preserving an untrusted cache layer and remove local artifacts through a controlled procedure. Do not globally delete directories on a shared host without identifying owners. First locate paths used by the process, preserve suspicious files for analysis and repopulate the cache from a pinned source.
For PDF, test legitimate documents with a large outline, documents without outlines, large files and a controlled case exceeding the structural limit. For ONNX, confirm directory ownership, permissions, behaviour when an existing file has the wrong digest and retrieval after a clean start. Tests should prove security without breaking a legitimate cold start.
Investigation and recovery
For stack errors, preserve the document hash, upload metadata, task identifier and retry logs. Do not open an unknown PDF on an analyst’s privileged workstation. Use an isolated parser and static tools. Establish whether the event failed one task or also caused queue loss, process restart or cross-tenant delay.
For ONNX cache concerns, compare each model’s hash and provenance with an approved manifest, then inspect owner, creation times and symbolic links. Identify processes that loaded the artifact and outputs they produced. When the model influenced security or customer data decisions, the incident may require re-computing indexes, classifications or reports.
There is no automatic need to rotate every secret merely because a mismatched model was found. Rotation is justified if analysis reveals runtime exploitation, credential access or broader host compromise. Otherwise, the priority is restoring artifact and output integrity.
Shared lesson: ingestion is an execution surface
Both flaws occur before an LLM call. A document controls parser behaviour while a model file controls runtime computation. The AI boundary starts at upload and cache rather than at the prompt. Prompt-injection scanning will not find a cyclic PDF outline or local ONNX substitution.
A pipeline manifest should record the source, digest, format, parser, runtime version, limits and owner of every artifact. Telemetry should link the document to subsequent representations: text, chunks, embeddings and vector-store records. That evidence identifies which outputs need rebuilding after an incident.
Source facts and Breachroad conclusions
PDF recursion, local ONNX substitution, affected versions, CVSS scores and fixed releases come from Spring’s advisories and CVE records. The vendor does not report active exploitation. RAG and embedding impact, worker isolation, artifact manifests, telemetry and investigation procedures are Breachroad conclusions.
AI, RAG and MLOps security training helps teams design safe ingestion, while application and API security assessments can evaluate document upload, model caches, worker isolation and artifact integrity.
