—
GO-2026-5781
Uncatchable stack-overflow denial of service in rsc.io/pdf
Details
pdf.Open and PDF object resolution in rsc.io/pdf recurse without bound on nested arrays and dictionaries. A sufficiently deeply nested document exhausts the goroutine stack limit and triggers a fatal, uncatchable stack overflow. Any service that parses untrusted PDFs with rsc.io/pdf can therefore be taken down by a single small input.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / rsc.io/pdf
Introduced in:
0 No fixed version published yet for rsc.io/pdf (go modules). Pin to a known-safe version or switch to an alternative.