https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 20:13:08 +0000 https://db.gcve.eu/vuln/rustsec-2026-0187 <p><strong>Affected:</strong> crates.io: lopdf</p> <p>`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`.</p> <p>Because this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.</p> <p>Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.</p> <p>## Proof of concept</p> <p>```rust fn main() { let bytes = std::fs::read(&#34;poc.pdf&#34;).unwrap(); // ~10,380-deep nested array in the Catalog let _ = lopdf::Document::load_mem(&amp;bytes); // stack overflow -&gt; SIGABRT } ```</p> <p>An equivalent PoC is a minimal PDF whose Catalog `/X` value is `&#34;[&#34; * 10380 + &#34;]&#34; * 10380`.</p> <p>## Suggested fix</p> <p>Enforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.</p> <p><strong>Affected:</strong> crates.io: lopdf</p> <p>`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`.</p> <p>Because this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.</p> <p>Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.</p> <p>## Proof of concept</p> <p>```rust fn main() { let bytes = std::fs::read(&#34;poc.pdf&#34;).unwrap(); // ~10,380-deep nested array in the Catalog let _ = lopdf::Document::load_mem(&amp;bytes); // stack overflow -&gt; SIGABRT } ```</p> <p>An equivalent PoC is a minimal PDF whose Catalog `/X` value is `&#34;[&#34; * 10380 + &#34;]&#34; * 10380`.</p> <p>## Suggested fix</p> <p>Enforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.</p> https://db.gcve.eu/vuln/rustsec-2026-0187