## https://sploitus.com/exploit?id=A0A1BA91-753A-5AB0-82B6-6C0A47087B5F
# Spring AI PDF Reader — sibling self-loop PoC (incomplete fix of CVE-2026-47851)
> Minimal reproduction for an infinite loop / OOM in
> `org.springframework.ai.reader.pdf.config.ParagraphManager` of
> `org.springframework.ai:spring-ai-pdf-document-reader`.
>
> Reported as a private GitHub Security Advisory to
> `spring-projects/security-advisories`. **Not a public disclosure.**
> This repository is shared only for **responsible disclosure and verification**.
---
## Vulnerability
`ParagraphManager.generateParagraphs` iterates outline siblings via
`getNextSibling()` with no cycle detection and no iteration cap. A PDF whose
outline item declares its own `/Next` pointer (a *sibling self-loop*) causes
the loop to never terminate; each iteration appends a new `Paragraph` to the
parent's `children` list, exhausting the JVM heap with `OutOfMemoryError`.
The check added in the CVE-2026-47851 fix (depth limit + visited set) only
covers `firstChild` cycles, not sibling self-loops: the depth never grows past
level 1, and the visited set only records `firstChild` so the sibling never
enters it. The variant therefore reproduces on the latest release
(`2.0.1`) as well.
| Item | Value |
|---|---|
| Affected component | `org.springframework.ai:spring-ai-pdf-document-reader` |
| Affected versions | `< 2.0.2` (all known releases; 1.x and 2.0.0 do not even contain the CVE-2026-47851 fix) |
| Vulnerable class | `org.springframework.ai.reader.pdf.config.ParagraphManager` |
| Trigger | `new ParagraphPdfDocumentReader(resource)` with a malicious PDF |
| Impact | `OutOfMemoryError`, process termination — DoS |
| Severity | 7.5 HIGH — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` |
| Related | CVE-2026-47851 (incomplete fix) |
---
## Files
```
pom.xml — Maven build, depends on spring-ai-pdf-document-reader:2.0.1
src/main/java/ReleaseVerify.java — real user code (official API call)
poc/selfloop.pdf — 396-byte malicious PDF (sibling self-loop)
poc/normal.pdf — 384-byte control PDF (identical except no /Next self-reference)
```
The two PDFs differ by exactly **12 bytes** — `selfloop.pdf` has one extra
`/Next 5 0 R` in the outline item, pointing the item to itself as its next
sibling.
---
## Build
```bash
mvn -q package
```
Produces `target/springai-release-verify-1.0.0.jar` (fat jar, includes
PDFBox 3.0.7).
## Reproduce
```bash
# Malicious PDF — OOM in seconds
java -Xmx96m -cp target/springai-release-verify-1.0.0.jar ReleaseVerify para poc/selfloop.pdf
# Control PDF — completes normally in <100ms
java -Xmx96m -cp target/springai-release-verify-1.0.0.jar ReleaseVerify para poc/normal.pdf
```
The OOM occurs inside the `ParagraphPdfDocumentReader` constructor (which
invokes `new ParagraphManager(document)`); `get()` is never reached.
---
## Scope of this repository
This repository exists **only** to support verification of the privately
reported advisory. The PDF files are harmless to PDFBox and any other
conformant PDF parser; they trigger a logic error in Spring AI's
`ParagraphManager` traversal only. Do not use against systems you do not own.