---
id: RUSTSEC-2026-0187
aliases:
  - GHSA-6fj4-rcr3-r7rr
title: Stack overflow in lopdf via deeply nested PDF objects
summary: Stack overflow in lopdf via deeply nested PDF objects
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: lopdf
product: lopdf
ecosystem: rust
affected:
  - 'lopdf >= 0.0.0-0, < 0.42.0'
patched:
  - lopdf 0.42.0
published: '2026-06-21'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T15:15:02.582897646Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0187'
references:
  - url: 'https://crates.io/crates/lopdf'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0187.html'
  - url: 'https://github.com/J-F-Liu/lopdf/issues/502'
  - url: 'https://github.com/J-F-Liu/lopdf/pull/503'
  - url: 'https://github.com/J-F-Liu/lopdf/commit/c755394'
tags:
  - osv
  - rust
ingestedAt: '2026-10-18T11:51:09.858Z'
---

## Overview

`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`.

Because this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

## Proof of concept

```rust
fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}
```

An equivalent PoC is a minimal PDF whose Catalog `/X` value is `"[" * 10380 + "]" * 10380`.

## Suggested fix

Enforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.

## Affected packages

- `lopdf >= 0.0.0-0, < 0.42.0`

## Remediation

Upgrade to a patched release:

- `lopdf 0.42.0`