GO-2026-6115
Multiple denial of service vulnerabilities in rsc.io/pdf and forks
Details
The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input:
- Unchecked /Size, /Index, /W, and classic subsection header parameters in cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) panics. - Unterminated hexadecimal strings cause an infinite loop in readByte and readHexString. - Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines cause unbounded recursion leading to uncatchable stack overflow. - Various malformed constructs trigger runtime panics in NewReader and Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, odd-length UTF-16 strings, and newline buffer underflows).
Are you affected?
Enter the version of the package you're using.
Affected packages
0 No fixed version published yet for rsc.io/pdf (go modules). Pin to a known-safe version or switch to an alternative.
0 No fixed version published yet for github.com/ledongthuc/pdf (go modules). Pin to a known-safe version or switch to an alternative.
0 No fixed version published yet for github.com/dslipak/pdf (go modules). Pin to a known-safe version or switch to an alternative.