{"id":"CVE-2026-56867","aliases":["GO-2026-6115"],"title":"Multiple denial of service vulnerabilities in rsc.io/pdf and forks","summary":"Multiple denial of service vulnerabilities in rsc.io/pdf and forks","severity":"none","vendor":"pdf","product":"rsc.io/pdf","ecosystem":"go","affected":["rsc.io/pdf","github.com/ledongthuc/pdf","github.com/dslipak/pdf"],"published":"2026-08-18","updated":"2026-08-18","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6115","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56867"},{"url":"https://github.com/golang/vulndb/issues/6115"},{"url":"https://github.com/ledongthuc/pdf/pull/78"},{"url":"https://github.com/rsc/pdf"},{"url":"https://github.com/dslipak/pdf"}],"tags":["osv","go"],"ingestedAt":"2026-08-18T19:21:37.923Z","slug":"CVE-2026-56867","body":"## Overview\n\nThe PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input:\n\n- Unchecked /Size, /Index, /W, and classic subsection header parameters in cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) panics.\n- Unterminated hexadecimal strings cause an infinite loop in readByte and readHexString.\n- Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines cause unbounded recursion leading to uncatchable stack overflow.\n- Various malformed constructs trigger runtime panics in NewReader and Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, odd-length UTF-16 strings, and newline buffer underflows).\n\n## Affected packages\n\n- `rsc.io/pdf`\n- `github.com/ledongthuc/pdf`\n- `github.com/dslipak/pdf`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}