GO-2026-6115
Multiple denial of service vulnerabilities in rsc.io/pdf and forks
상세
The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input:
- Unchecked /Size, /Index, /W, and classic subsection header parameters in cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) panics. - Unterminated hexadecimal strings cause an infinite loop in readByte and readHexString. - Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines cause unbounded recursion leading to uncatchable stack overflow. - Various malformed constructs trigger runtime panics in NewReader and Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, odd-length UTF-16 strings, and newline buffer underflows).
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
0 No fixed version published yet for rsc.io/pdf (go modules). Pin to a known-safe version or switch to an alternative.
0 No fixed version published yet for github.com/ledongthuc/pdf (go modules). Pin to a known-safe version or switch to an alternative.
0 No fixed version published yet for github.com/dslipak/pdf (go modules). Pin to a known-safe version or switch to an alternative.