What is the CVSS score of CVE-2026-33438?

CVE-2026-33438 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Stirling Pdf are affected by CVE-2026-33438?

Organizations using 2.1.5 and should be aware of notable risk from CVE-2026-33438 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-33438?

Within 30 days: Identify affected systems running 2.1.5 and and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Stirling Pdf CVE-2026-33438

EUVD-2026-16262 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-26 GitHub_M

Denial Of Service Stirling Pdf Stirling Tools

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.2

EUVD ID Assigned

Mar 26, 2026 - 17:15 euvd

EUVD-2026-16262

Analysis Generated

Mar 26, 2026 - 17:15 vuln.today

CVE Published

Mar 26, 2026 - 16:58 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Versions starting in 2.1.5 and prior to 2.5.2 have Denial of Service (DoS) vulnerability in the Stirling-PDF watermark functionality (/api/v1/security/add-watermark endpoint). The vulnerability allows authenticated users to cause resource exhaustion and server crashes by providing extreme values for the fontSize and widthSpacer parameters. Version 2.5.2 patches the issue.

AnalysisAI

Stirling-PDF versions 2.1.5 through 2.5.1 are vulnerable to resource exhaustion denial of service through the watermark API endpoint, where authenticated users can supply extreme values for fontSize and widthSpacer parameters to crash the server. A proof-of-concept exists according to SSVC data, and the vendor has released patched version 2.5.2 to resolve the issue.

Technical ContextAI

Stirling-PDF is a locally hosted web application for PDF manipulation operations. The vulnerability exists in the /api/v1/security/add-watermark endpoint, which processes user-supplied parameters for watermark rendering. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), indicating the application fails to enforce constraints on resource allocation when processing watermark dimension parameters. The affected product is identified via CPE cpe:2.3:a:stirling-tools:stirling-pdf:*:*:*:*:*:*:*:* and impacts all versions from 2.1.5 up to but not including 2.5.2. The vulnerability exploits the watermark rendering pipeline's lack of input validation for numeric parameters that directly control memory and CPU consumption.

RemediationAI

Upgrade Stirling-PDF to version 2.5.2 or later, which contains the vendor-released patch resolving the resource exhaustion vulnerability in the watermark endpoint. Organizations unable to upgrade immediately should implement network-level access controls restricting access to the /api/v1/security/add-watermark endpoint to trusted administrative users only, disable the watermark feature if not operationally required, and monitor for abnormal resource consumption patterns (CPU spikes, memory growth) that may indicate exploitation attempts. Refer to the vendor advisory at https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3932-2rfq-87xm for detailed upgrade instructions.