Description

pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.

Related CPE's

Could not find any relations

References

https://github.com/pdfcpu/pdfcpu

https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L325-L366

https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L942-L970

https://github.com/pdfcpu/pdfcpu/commit/9db810afb52b555ffcae955b32c0be3a73eb53d3

https://github.com/pdfcpu/pdfcpu/releases/tag/v0.12.0

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-674

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 · High

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-07-02T21:16:56.150Z

3 months ago

Last modified

2026-08-21T14:16:49.030Z

1 month ago