CVE-2026-124553 · Package
NO FIX YET · SEE WHAT TO DO
BabelDOC, a PDF translation library, mishandles huge bfrange and cidrange spans in embedded ToUnicode CMaps. A remote attacker who submits a crafted PDF can exhaust CPU and memory and stall the translation worker.
first public Nov 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run BabelDOC on PDFs supplied by outside users, such as a translation web service or upload pipeline, are exposed. Local use on trusted documents is lower risk. Teams that only use BabelDOC on their own files can skip it.
Not affected if trusted-input-only, versions-before-0.3.61-or-0.7.0-plus
Who cares pdf, python, translation
pip show babeldoc and compare it to the fixed range below.0.7.0 (affected range is 0.3.61 before 0.7.0).BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares a huge range, driving billions of loop iterations and stalling the translation worker.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.