CVE-2026-38970 - Vulnerability Details

Description

pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.

Published: 2026-07-02

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

pdfcpu is a Go library for PDF manipulation. The vulnerability lies in the parser, where the functions ParseObjectContext() and parseArray() walk through nested PDF objects without imposing a maximum depth. A PDF file that contains deeply nested objects can exhaust stack or heap memory, causing the process to crash or hang and thereby denying service. The flaw is triggered by a crafted PDF file.

Affected Systems

All deployments that use pdfcpu through version 0.11.1 for handling PDFs are affected. The issue resides in the library’s parse.go file and is distributed via GitHub and Go modules. Because no vendor namespace is explicitly tied to the library, any project that embeds pdfcpu v0.11.1 or earlier is vulnerable.

Risk and Exploitability

The CVSS score of 7.5 marks the fault as high severity. The EPSS score of less than 1% indicates a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. An attacker merely needs a PDF document that triggers deep recursion; the likely attack vector is the remote ingestion of such a crafted PDF. Exploitation conditions are minimal beyond the presence of the vulnerable library.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

Vendor Product Confidence Versions

Pdfcpu

80%

Version	Status	Scheme	Platform
`[0,0.11.1]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade pdfcpu to the latest release that includes a recursion depth limit.
If an upgrade cannot be performed immediately, constrain the resources available to applications stack limits to prevent exhaustion and mitigate hangs.
Monitor application logs for stack overflows, out‑of-memory errors, or process restarts during PDF processing and configure alerts to detect prolonged disruptions.

Generated by OpenCVE AI on August 1, 2026 at 22:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00451.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/pdfcpu/pdfcpu
https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L325-L366
https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L942-L970

History

Sat, 01 Aug 2026 22:30:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser

Wed, 29 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Pdfcpu Pdfcpu pdfcpu
Vendors & Products		Pdfcpu Pdfcpu pdfcpu

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion Denial-of-Service in pdfcpu PDF Parser

Wed, 22 Jul 2026 14:15:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion Denial-of-Service in pdfcpu PDF Parser

Fri, 17 Jul 2026 12:00:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion Leading to Denial of Service in pdfcpu PDF Parser

Wed, 15 Jul 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion Leading to Denial of Service in pdfcpu PDF Parser

Tue, 14 Jul 2026 18:00:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion Denial of Service in pdfcpu Parser

Mon, 13 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion Denial of Service in pdfcpu Parser

Sun, 12 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Title	pdfcpu Recursion‑Depth Denial of Service in PDF Parsing

Sat, 11 Jul 2026 07:30:00 +0000

Type	Values Removed	Values Added
Title		pdfcpu Recursion‑Depth Denial of Service in PDF Parsing

Fri, 10 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser

Thu, 09 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser

Thu, 09 Jul 2026 06:00:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion PDF Parser

Wed, 08 Jul 2026 13:15:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion PDF Parser

Tue, 07 Jul 2026 09:00:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion in pdfcpu Parser Causes Denial of Service

Mon, 06 Jul 2026 20:00:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion in pdfcpu Parser Causes Denial of Service

Mon, 06 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-674
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 06 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursive Parsing Causes Denial‑of‑Service in pdfcpu
Weaknesses	CWE-119 CWE-123

Mon, 06 Jul 2026 02:45:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursive Parsing Causes Denial‑of‑Service in pdfcpu
Weaknesses		CWE-119 CWE-123

Sun, 05 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser
Weaknesses	CWE-674 CWE-770

Sat, 04 Jul 2026 18:45:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser
Weaknesses		CWE-674 CWE-770

Sat, 04 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion in pdfcpu PDF Parser Causes Denial of Service
Weaknesses	CWE-674

Fri, 03 Jul 2026 18:45:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion in pdfcpu PDF Parser Causes Denial of Service
Weaknesses		CWE-674

Fri, 03 Jul 2026 11:00:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Recursion Leading to Denial of Service in pdfcpu PDF Parser
Weaknesses	CWE-749

Fri, 03 Jul 2026 04:00:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Recursion Leading to Denial of Service in pdfcpu PDF Parser
Weaknesses		CWE-749

Thu, 02 Jul 2026 21:15:00 +0000

Type	Values Removed	Values Added
Description		pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.
References		https://github.com/pdfcpu/pdfcpu https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L325-L366 https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L942-L970

Subscriptions

Pdfcpu Pdfcpu

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-07-02T00:00:00.000Z

Updated: 2026-07-06T14:44:12.877Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-38970

Vulnrichment

Updated: 2026-07-06T14:43:55.609Z

NVD

Status : Deferred

Published: 2026-07-02T21:16:56.150

Modified: 2026-07-06T19:47:25.753

Link: CVE-2026-38970

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-01T22:30:06Z

Weaknesses

CWE-674
Uncontrolled Recursion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object