pdfcpu CVE-2026-38970
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated attacker delivers a crafted PDF over the network with no interaction; sole impact is process crash, so C:N/I:N/A:H, matching the published vector.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.
AnalysisAI
Denial of service in pdfcpu (the Go PDF processing library and CLI) through v0.11.1 lets a remote attacker crash any application that parses attacker-supplied PDFs by submitting a document with deeply nested objects. The parser follows nested arrays recursively via ParseObjectContext() and parseArray() with no depth cap, so a crafted file exhausts the goroutine stack and aborts the process. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile), consistent with an availability-only bug rather than a code-execution risk.
Technical ContextAI
pdfcpu is an open-source Go library and command-line tool for reading, writing, and manipulating PDF files, commonly embedded in Go services that accept user-uploaded documents. The root cause is CWE-674 (Uncontrolled Recursion): the object parser in pkg/pdfcpu/model/parse.go descends into nested PDF objects - the PDF format permits arrays and dictionaries nested to arbitrary depth - by mutual recursion between ParseObjectContext() (referenced at lines 325-366) and parseArray() (lines 942-970), without tracking or bounding the current nesting depth. Because Go grows goroutine stacks until an internal limit is hit and then fatally panics with 'stack overflow', a sufficiently nested structure terminates the process rather than returning a recoverable parse error.
Affected ProductsAI
pdfcpu through (and including) version v0.11.1 is affected, per the CVE description; the vulnerable code is in pkg/pdfcpu/model/parse.go in the pdfcpu/pdfcpu GitHub repository (https://github.com/pdfcpu/pdfcpu). No CPE strings were provided in the intelligence data, so exact packaging (library import path github.com/pdfcpu/pdfcpu vs. the standalone CLI) is not enumerated by NVD, but both the library and CLI share the affected parser. Any downstream Go application vendoring pdfcpu at v0.11.1 or earlier inherits the flaw.
RemediationAI
Upgrade to a pdfcpu release later than v0.11.1 that enforces a maximum parse nesting depth; the references cite the upstream repository (https://github.com/pdfcpu/pdfcpu) and the specific vulnerable lines (parse.go L325-366 and L942-970), but no exact fixed version tag is included in the provided data, so confirm the patched release on the project's releases page before pinning - released patched version not independently confirmed from available data. As compensating controls until upgrade, cap the size of accepted PDFs (deeply nested payloads are usually small, so size limits help only marginally) and, more effectively, run pdfcpu parsing in an isolated worker process or sandbox with automatic restart so a stack-overflow crash cannot take down the main service; alternatively pre-screen or reject documents from untrusted sources. Each of these adds latency or operational overhead and none fully prevents the crash, so treat them as stopgaps rather than a fix.
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today