CVE-2026-38970

HIGH

pdfcpu <= 0.11.1 - Denial of Service via Uncontrolled Recursion in Nested PDF Object Parser

Title source: llm

Description

pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.

References (3)

Core 3

Core References

https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L325-L366

https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L942-L970

https://github.com/pdfcpu/pdfcpu

Scores

CVSS v3 7.5

EPSS 0.0045

EPSS Percentile 37.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-674

Status published

Published Jul 02, 2026

Tracked Since Jul 03, 2026