Live › vulnerability › GHSA-6fj4-rcr3-r7rr
Go to dashboardlopdf, a Rust PDF library, recurses without a depth limit when parsing nested arrays and dictionaries, so a small crafted PDF with about 10,000 nesting levels overflows the stack. An attacker who can get a service to parse an untrusted PDF crashes the whole process with SIGABRT, which cannot be caught, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| lopdf | cargo | < 0.42.0 | 0.42.0 |
Check Cargo.lock for lopdf: run cargo tree -i lopdf or grep -A1 'name = "lopdf"' Cargo.lock and look for a version below 0.42.0.
0.42.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.
Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.
Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.
fn main() {
let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
let _ = lopdf::Document::load_mem(&bytes); // stack overflow -> SIGABRT
}
An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.
Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.
This page as .md · .json · in your agent: get_signal("GHSA-6fj4-rcr3-r7rr")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.