{"id":"GHSA-6fj4-rcr3-r7rr","aliases":["RUSTSEC-2026-0187"],"status":"published","title":"lopdf has a stack overflow via deeply nested PDF objects","description":"`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`.\n\nBecause this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.\n\nConfirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.\n\n## Proof of concept\n\n```rust\nfn main() {\n    let bytes = std::fs::read(\"poc.pdf\").unwrap(); // ~10,380-deep nested array in the Catalog\n    let _ = lopdf::Document::load_mem(\u0026bytes);     // stack overflow -\u003e SIGABRT\n}\n```\n\nAn equivalent PoC is a minimal PDF whose Catalog `/X` value is `\"[\" * 10380 + \"]\" * 10380`.\n\n## Suggested fix\n\nEnforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1124"],"published":"2026-06-21T12:00:00Z","modified":"2026-10-17T15:26:01Z","fixes":[{"ecosystem":"crates.io","package":"lopdf","fixed_in":["0.42.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"lopdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.42.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"lopdf","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.42.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"lopdf","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.42.0"}]}]}],"references":[{"url":"https://github.com/J-F-Liu/lopdf/issues/502","tags":["web","report"]},{"url":"https://github.com/J-F-Liu/lopdf/pull/503","tags":["web"]},{"url":"https://github.com/J-F-Liu/lopdf/commit/c755394ad7dd651ccfe77c618f90ab779da1dfd9","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0187.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6fj4-rcr3-r7rr"},{"url":"https://github.com/J-F-Liu/lopdf","tags":["package"]},{"url":"https://crates.io/crates/lopdf","tags":["package"]},{"url":"https://github.com/J-F-Liu/lopdf/commit/c755394","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-6fj4-rcr3-r7rr","title":"lopdf has a stack overflow via deeply nested PDF objects","description":"`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`.\n\nBecause this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.\n\nConfirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.\n\n## Proof of concept\n\n```rust\nfn main() {\n    let bytes = std::fs::read(\"poc.pdf\").unwrap(); // ~10,380-deep nested array in the Catalog\n    let _ = lopdf::Document::load_mem(\u0026bytes);     // stack overflow -\u003e SIGABRT\n}\n```\n\nAn equivalent PoC is a minimal PDF whose Catalog `/X` value is `\"[\" * 10380 + \"]\" * 10380`.\n\n## Suggested fix\n\nEnforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.","status":"published","published":"2026-10-16T19:55:39Z","modified":"2026-10-16T19:55:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1124"],"updated_at":"2026-11-02T14:41:32.483482Z"}],"osv":[{"id":"GHSA-6fj4-rcr3-r7rr","title":"lopdf has a stack overflow via deeply nested PDF objects","description":"`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`.\n\nBecause this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.\n\nConfirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.\n\n## Proof of concept\n\n```rust\nfn main() {\n    let bytes = std::fs::read(\"poc.pdf\").unwrap(); // ~10,380-deep nested array in the Catalog\n    let _ = lopdf::Document::load_mem(\u0026bytes);     // stack overflow -\u003e SIGABRT\n}\n```\n\nAn equivalent PoC is a minimal PDF whose Catalog `/X` value is `\"[\" * 10380 + \"]\" * 10380`.\n\n## Suggested fix\n\nEnforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.","status":"published","published":"2026-10-16T19:55:39Z","modified":"2026-10-17T15:26:01.305676388Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1124"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"RUSTSEC-2026-0187","title":"Stack overflow in lopdf via deeply nested PDF objects","description":"`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`.\n\nBecause this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.\n\nConfirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.\n\n## Proof of concept\n\n```rust\nfn main() {\n    let bytes = std::fs::read(\"poc.pdf\").unwrap(); // ~10,380-deep nested array in the Catalog\n    let _ = lopdf::Document::load_mem(\u0026bytes);     // stack overflow -\u003e SIGABRT\n}\n```\n\nAn equivalent PoC is a minimal PDF whose Catalog `/X` value is `\"[\" * 10380 + \"]\" * 10380`.\n\n## Suggested fix\n\nEnforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.","status":"published","published":"2026-06-21T12:00:00Z","modified":"2026-10-17T15:15:02.582897646Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}