Junglewise Threat Intelligence

CVE-2026-38970: pdfcpu uncontrolled recursion DoS in PDF parser

CVE-2026-38970 · Severity: info · CVSS 0 · Published 2026-07-02

Executive brief

pdfcpu is a tool and library used for processing and validating PDF files. A vulnerability in its parsing engine allows a specially crafted PDF file with deeply nested objects to crash the application. This can lead to a denial-of-service, preventing users or automated systems from processing PDF documents.

Technical details

An uncontrolled recursion vulnerability exists in pkg/pdfcpu/model/parse.go within pdfcpu through version 0.11.1. The parser's ParseObjectContext() and parseArray() functions descend recursively through nested PDF objects and arrays without enforcing a maximum nesting depth. An attacker can exploit this by providing a maliciously crafted PDF containing deeply nested structures, leading to a stack overflow and subsequent denial-of-service (DoS). This is a classic recursive descent parser issue where resource consumption is not bounded.

Affected products

  • pdfcpu pdfcpu through v0.11.1

Timeline

  • 2026-07-02: disclosed: CVE published to NVD

References