{"id":"GHSA-6fj4-rcr3-r7rr","title":"lopdf has a stack overflow via deeply nested PDF objects","summary":"lopdf has a stack overflow via deeply nested PDF objects","severity":"high","cvss":7.5,"cwe":["CWE-1124"],"vendor":"lopdf","product":"lopdf","ecosystem":"rust","affected":["lopdf < 0.42.0"],"patched":["lopdf 0.42.0"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:55:40Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6fj4-rcr3-r7rr","references":[{"url":"https://github.com/J-F-Liu/lopdf/issues/502"},{"url":"https://github.com/J-F-Liu/lopdf/pull/503"},{"url":"https://github.com/J-F-Liu/lopdf/commit/c755394ad7dd651ccfe77c618f90ab779da1dfd9"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0187.html"},{"url":"https://github.com/advisories/GHSA-6fj4-rcr3-r7rr"}],"tags":["ghsa","rust"],"ingestedAt":"2026-10-16T20:51:39.884Z","slug":"GHSA-6fj4-rcr3-r7rr","body":"## Overview\n\n`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`.\n\nBecause this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.\n\nConfirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.\n\n## Proof of concept\n\n```rust\nfn main() {\n    let bytes = std::fs::read(\"poc.pdf\").unwrap(); // ~10,380-deep nested array in the Catalog\n    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT\n}\n```\n\nAn equivalent PoC is a minimal PDF whose Catalog `/X` value is `\"[\" * 10380 + \"]\" * 10380`.\n\n## Suggested fix\n\nEnforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.\n\n## Affected packages\n\n- `lopdf < 0.42.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `lopdf 0.42.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}