Multiple denial of service vulnerabilities in rsc.io/pdf and forks

Overview

The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input:

• Unchecked /Size, /Index, /W, and classic subsection header parameters in cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) panics.
• Unterminated hexadecimal strings cause an infinite loop in readByte and readHexString.
• Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines cause unbounded recursion leading to uncatchable stack overflow.
• Various malformed constructs trigger runtime panics in NewReader and Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, odd-length UTF-16 strings, and newline buffer underflows).

Affected packages

• rsc.io/pdf
• github.com/ledongthuc/pdf
• github.com/dslipak/pdf

Remediation

Refer to the advisory for the patched release.