veraPDF-parser contains a denial‑of‑service flaw in its handling of Type 0 font /Encoding or /ToUnicode CMap streams. A crafted stream can trigger an unbounded PostScript array allocation or an infinite zero‑increment loop, exhausting the validator’s memory or CPU resources. The vulnerability is a classic unbounded loop or allocation weakness (CWE‑1325) that can bring a server or application that parses PDFs into an unresponsive state.

The flaw affects all installations of veraPDF-parser before version 1.30.2 and before version 1.31.23. Those releases—including any newer branch that inherits the same code base without the patch—are vulnerable. Upgrading to 1.30.2 or later (or to 1.31.23 or later) eliminates the issue.

The published CVSS score is 6.9, and the EPSS score is below 1 %, indicating a low probability of automated exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to provide a malicious PDF that is parsed by the vulnerable version, making the attack vector a remote DoS triggered by client‑supplied data.