EUVD-2026-50371
GHSA-jrmc-qg6p-94fp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable PDF processing with no auth needed; uncaught OutOfMemoryError terminates the JVM process entirely, warranting High rather than the provided Low availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 0 font /Encoding or /ToUnicode CMap stream can execute unbounded PostScript array allocation or a zero-increment for loop and exhaust validator memory or CPU. This issue is fixed in versions 1.30.2 and 1.31.23.
AnalysisAI
Memory and CPU exhaustion in veraPDF-parser's embedded PostScript interpreter allows remote unauthenticated attackers to crash the PDF validator by submitting a single crafted PDF. All 1.30.x releases prior to 1.30.2 and all 1.31.x releases prior to 1.31.23 of the Maven artifact org.verapdf:parser are affected. No public exploit code has been confirmed at time of analysis, but the GHSA advisory discloses the exact operator names, payload byte sequence, and affected source line numbers, making independent reproduction trivial without requiring any structural PDF framing.
Technical ContextAI
veraPDF-parser is a Java-based PDF/A validation library (Maven: org.verapdf:parser, CPE: cpe:2.3:a:verapdf:verapdf-parser:*:*:*:*:*:*:*:*) that parses CMap streams embedded in Type 0 font /Encoding entries and any font's /ToUnicode entries via CMapParser, which extends PSParser. Tokens not recognized as CMap-specific keywords fall through to PSObject.execute, which dispatches generic PostScript operators in PSOperator. CWE-1325 (Improper Control of Loop Bounds) manifests in two operators: (1) the array operator at PSOperator.java:536-547 allocates a Java ArrayList of attacker-specified size up-front via COSArray.construct(arraySize), meaning the payload 2147483647 array requests approximately 16 GB of JVM heap immediately; (2) the for operator at PSOperator.java:571-592 reads initial, increment, and limit from the stack and loops without a zero-increment guard, so 0 0 1 { } for produces an infinite CPU spin while also progressively growing the operand stack. CMapFactory.getCMap catches only IOException and PostScriptException, leaving OutOfMemoryError to propagate uncaught and abort the validation worker.
RemediationAI
Upgrade the Maven artifact org.verapdf:parser to version 1.30.2 (for consumers on the 1.30.x branch) or 1.31.23 (for consumers on the 1.31.x branch), as confirmed by the vendor in the GHSA advisory at https://github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-jrmc-qg6p-94fp. The fix is implemented in pull request #703 (https://github.com/veraPDF/veraPDF-parser/pull/703) via commits 73d6ec002b98ce1f3f68640442f8e5d5613c80ce and cb3538607a549d63504299be1088c85ae48605f4: the array operator now validates allocation size before calling COSArray.construct, and the for operator guards against zero-increment by skipping the loop body and logging a warning rather than executing indefinitely. If immediate patching is not possible, a compensating control is to pre-screen uploaded PDFs for embedded CMap streams containing PostScript operator tokens using a content-inspection proxy or YARA rule targeting array or for tokens in font stream data - note this approach may false-positive on legitimate PDFs using standard PostScript CMap notation and would require careful tuning to avoid blocking valid documents.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today