Executive brief
pdfcpu is a tool and library used for processing and validating PDF files. A vulnerability in its parsing engine allows a specially crafted PDF file with deeply nested objects to crash the application. This can lead to a denial-of-service, preventing users or automated systems from processing PDF documents.
Technical details
An uncontrolled recursion vulnerability exists in pkg/pdfcpu/model/parse.go within pdfcpu through version 0.11.1. The parser's ParseObjectContext() and parseArray() functions descend recursively through nested PDF objects and arrays without enforcing a maximum nesting depth. An attacker can exploit this by providing a maliciously crafted PDF containing deeply nested structures, leading to a stack overflow and subsequent denial-of-service (DoS). This is a classic recursive descent parser issue where resource consumption is not bounded.
Affected products
- pdfcpu pdfcpu through v0.11.1
Timeline
- 2026-07-02: disclosed: CVE published to NVD