{"id":"GO-2026-5781","aliases":[],"status":"published","title":"Uncatchable stack-overflow denial of service in rsc.io/pdf","description":"pdf.Open and PDF object resolution in rsc.io/pdf recurse without bound on nested arrays and dictionaries. A sufficiently deeply nested document exhausts the goroutine stack limit and triggers a fatal, uncatchable stack overflow. Any service that parses untrusted PDFs with rsc.io/pdf can therefore be taken down by a single small input.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-07-27T16:16:22Z","modified":"2026-07-27T17:00:22Z","affected":[{"source":"osv","ecosystem":"Go","package":"rsc.io/pdf","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/golang/vulndb/issues/5781","tags":["report"]},{"url":"https://github.com/rsc/pdf","tags":["web"]}],"sources":{"osv":[{"id":"GO-2026-5781","title":"Uncatchable stack-overflow denial of service in rsc.io/pdf","description":"pdf.Open and PDF object resolution in rsc.io/pdf recurse without bound on nested arrays and dictionaries. A sufficiently deeply nested document exhausts the goroutine stack limit and triggers a fatal, uncatchable stack overflow. Any service that parses untrusted PDFs with rsc.io/pdf can therefore be taken down by a single small input.","status":"published","published":"2026-07-27T16:16:22Z","modified":"2026-07-27T17:00:22.688826404Z","updated_at":"2026-11-02T15:47:02.838915Z"}]}}