Spring AI 2.0.1: Seven CVEs Fixed, Tool Call Limits, and Streaming Reliability

Spring AI 2.0.1 is out, and it's a big one for a maintenance release: over 80 issues and PRs, most driven by teams that moved to 2.0.0 GA in the past weeks. The headline is security — seven CVEs fixed — but the release also adds a few capabilities that were frequently requested since GA.

Security fixes you should care about

Seven CVEs are patched in this release. The most serious ones:

• CVE-2026-47851 — unbounded recursion over attacker-controlled PDF outline tree in the PDF Document Reader. A crafted PDF could crash the reader or worse.
• CVE-2026-47852 — predictable cache directory location allows local ONNX model substitution. An attacker with local access could swap a model file.
• CVE-2026-59279 — unbounded persistent session allocation via repeated initialize requests. A DoS vector.
• CVE-2026-59294 — arbitrary file write via path traversal in ResourceCacheService.
• CVE-2026-59308 — semantic cache cross-tenant isolation bypass via SHA-256 truncation.
• CVE-2026-59319 — RediSearch tag injection in RedisChatMemoryRepository allows cross-conversation data exposure.
• CVE-2026-59318 — DefaultToolCallingManager global resolver fallback allows unadvertised tool dispatch via prompt injection.

If you're on 2.0.0, bump to 2.0.1 now. Most apps can just change the version, but a few changes need attention.

Breaking changes before you upgrade

• Mistral AI chat models deprecated in 2.0.0 are now retired. If you reference them by constant, switch to a supported model name.
• The Redis chat memory auto-config module was renamed to match the spring-ai-autoconfigure-* naming. Update the artifact ID.
• OpenAI tool-calling strict mode now defaults to false. Previously, any tool with an optional parameter failed with a 400 error because the generated schema omitted it from required. Strict mode is now opt-in, matching the OpenAI API default.
• Media builders use typed data overloads instead of accepting Object.
• DeepSeekApi was revised to align with the conventions of other API clients.
• The Couchbase vector store now uses the Spring Boot-managed Couchbase client instead of creating its own.

New capabilities

Tool call limits. The agentic loop that never terminates is an expensive failure mode. ToolCallingAdvisor now accepts a configurable limit on tool calls per request and raises ToolCallLimitExceededException when hit. The exception path returns a single Generation so error handling stays consistent. Tool resolution fallback is also configurable: fail fast or fall back.

OpenAI audio. OpenAiAudioSpeechModel supports audio streaming and exposes the instructions option for steering voice and delivery. Transcription options and responses were enriched to cover more of the OpenAI API surface.

Google GenAI. Gains ToolChoice support (force, disable, or leave to the model) and image generation through the standard ImageModel abstraction.

Document reading. PagePdfDocumentReader accepts page ranges, so you can ingest a section of a large document. TokenTextSplitter now validates builder arguments early instead of failing later with a confusing error.

AWS region resolution. Spring AI now follows the AWS SDK's default region resolution rules and no longer logs a confusing WARN while resolving the region. If you relied on environment or profile-based region config for Bedrock, it now behaves like the rest of your AWS stack.

Reliability: streaming and tool calling get the bulk of the attention

Streaming fixes include: OpenAiChatModel merges streaming tool call deltas by index, handles empty tool_calls chunks, and resolves zero token usage in streaming mode. Cancelling a stream no longer leaks the underlying HTTP response, for both chat and audio transcription. The ToolCallingAdvisor streaming loop no longer drops doBeforeStream mutations, token usage is accumulated across tool-calling iterations, and tool call observations get the correct parent span in blocking mode.

Also fixed: shared mutable state in chat options builder clone() (and Anthropic's), ToolContext parameter detection, strict mode payload placement, PDF media mapping in OpenAiChatModel, Optional unwrapping in buildGeneration, reasoningContent metadata when calling DeepSeek through the OpenAI API, AnthropicChatOptions.timeout(Duration) being ignored outside model construction, OllamaChatModel prompt options not inheriting the configured model, Google GenAI thinking-level validation, null fields in Mistral AI moderation results, Microsoft Foundry URL path handling for proxy hosts, and Azure OpenAI authentication behind a TLS-inspecting proxy.

The tool-search advisor introduced in 2.0.0 is now included in the BOM — it was missing, which made it awkward to depend on — with fixes for auto-configuration ordering and reference extraction for parallel tool calls.