Spring AI 1.1.x Release Notes

Security Fixes

• A deeply nested or cyclic PDF document outline can no longer exhaust the ingesting thread's stack in ParagraphManager, which now refuses outlines nested beyond a fixed depth and skips outline nodes it has already visited (high severity, CVE-2026-47851).
• DefaultToolCallingManager now executes only the tools a request advertises, whether through its toolCallbacks or its toolNames. A tool named by the model but advertised by neither is no longer resolved through the application-wide ToolCallbackResolver and executed, unless spring.ai.tools.resolution.fallback.enabled is explicitly set to true (medium severity, CVE-2026-59318).
• ResourceCacheService's no-argument constructor now caches into a per-process private temporary directory instead of a predictable one under the shared system temp directory, so a local user on the same host can no longer pre-create that directory and substitute the ONNX model an embedding model loads (high severity, CVE-2026-47852).
  • ResourceCacheService.getCachedFile now checks the resolved file's canonical path against the cache directory, so a model or tokenizer URI carrying ../ can no longer place downloaded bytes outside it (medium severity, CVE-2026-59294).

Dependency Upgrades

• Spring Boot (NES) 3.5.16-spring-boot-3.5.19