# CVE-2026-54081: veraPDF veraPDF-parser denial of service in Type 1 font parsing

Source: https://junglewise.ai/threats/cve-2026-54081-verapdf-verapdf-parser-denial-of-service-in-type-1-font-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-54081 · Severity: medium · CVSS 4 · Published 2026-07-29

veraPDF is an open-source PDF validator used to ensure files comply with archival standards. A vulnerability in its PDF parsing component allows a specially crafted PDF file to crash the application or exhaust its system resources (CPU and memory). This could lead to a denial-of-service, preventing the system from processing other documents or causing automated validation workflows to hang.

Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-54081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54081 being exploited in the wild.

**How severe is CVE-2026-54081?** Medium severity, with a CVSS score of 4, published 29 July 2026.

**Which products and versions are affected?** org.verapdf:parser (Maven) ECOSYSTEM:introduced=0,fixed=1.30.2; veraPDF Consortium veraPDF <= 1.30.1, >= 1.31.1, <= 1.31.22.

**Is there a fix for CVE-2026-54081?** Yes. org.verapdf:parser (Maven): upgrade to 1.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54081 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54081?** Check whether you run org.verapdf:parser (Maven) or veraPDF Consortium veraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.verapdf:parser (Maven): upgrade to 1.30.2 or later

  ```sh
  # set org.verapdf:parser to 1.30.2 in your pom.xml or build.gradle
  ```


## Technical details

A denial-of-service vulnerability exists in the Type 1 font program parser of veraPDF-parser (specifically within Type1FontProgram.java and PSOperator.java). The parser's PostScript interpreter fails to validate operands for the 'array' and 'for' operators, allowing for unbounded memory allocation (up to Integer.MAX_VALUE) and infinite loops via zero-increment values. Additionally, the 'toExecute' function lacks recursion depth limits, enabling stack exhaustion through self-referential dictionary lookups. An attacker can trigger these conditions by providing a PDF with a malicious /FontFile stream, leading to OutOfMemoryError, StackOverflowError, or CPU exhaustion. The issue is resolved in versions 1.30.2 and 1.31.23 by implementing operand validation and recursion limits.

## Affected products

- veraPDF veraPDF-parser < 1.30.2, >= 1.31.1, < 1.31.23

## Identifiers

- CVE-2026-54081
- GHSA-7c26-995w-6f47

## Timeline

- 2026-05-19: other: Initial fix pull request submitted
- 2026-05-29: patched: Fix merged into integration branch
- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: CVE published to NVD

## References

- [https://github.com/veraPDF/veraPDF-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce](https://github.com/veraPDF/veraPDF-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce)
- [https://github.com/veraPDF/veraPDF-parser/commit/cb3538607a549d63504299be1088c85ae48605f4](https://github.com/veraPDF/veraPDF-parser/commit/cb3538607a549d63504299be1088c85ae48605f4)
- [https://github.com/veraPDF/veraPDF-parser/pull/703](https://github.com/veraPDF/veraPDF-parser/pull/703)
- [https://github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-7c26-995w-6f47](https://github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-7c26-995w-6f47)

## Related threats

- [veraPDF veraPDF-parser denial of service in PostScript CMap streams](https://junglewise.ai/threats/cve-2026-54080-verapdf-verapdf-parser-denial-of-service-in-postscript-cmap)