---
id: CVE-2026-56867
aliases:
  - GO-2026-6115
title: Multiple denial of service vulnerabilities in rsc.io/pdf and forks
summary: Multiple denial of service vulnerabilities in rsc.io/pdf and forks
severity: none
vendor: pdf
product: rsc.io/pdf
ecosystem: go
affected:
  - rsc.io/pdf
  - github.com/ledongthuc/pdf
  - github.com/dslipak/pdf
published: '2026-08-18'
updated: '2026-08-18'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6115'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56867'
  - url: 'https://github.com/golang/vulndb/issues/6115'
  - url: 'https://github.com/ledongthuc/pdf/pull/78'
  - url: 'https://github.com/rsc/pdf'
  - url: 'https://github.com/dslipak/pdf'
tags:
  - osv
  - go
ingestedAt: '2026-08-18T19:21:37.923Z'
---

## Overview

The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input:

- Unchecked /Size, /Index, /W, and classic subsection header parameters in cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) panics.
- Unterminated hexadecimal strings cause an infinite loop in readByte and readHexString.
- Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines cause unbounded recursion leading to uncatchable stack overflow.
- Various malformed constructs trigger runtime panics in NewReader and Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, odd-length UTF-16 strings, and newline buffer underflows).

## Affected packages

- `rsc.io/pdf`
- `github.com/ledongthuc/pdf`
- `github.com/dslipak/pdf`

## Remediation

Refer to the advisory for the patched release.