{"id":"ghsa-ghsa-6fj4-rcr3-r7rr","seq":2452,"kind":"advisory","title":"lopdf has a stack overflow via deeply nested PDF objects","url":"https://github.com/advisories/GHSA-6fj4-rcr3-r7rr","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6fj4-rcr3-r7rr","summary":"影響: rust:lopdf < 0.42.0 → 0.42.0\nlopdf::Document::load_mem (and the other load entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT. Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting i…","severity":"high","techs":["rust"],"cves":[],"tags":["GHSA-6fj4-rcr3-r7rr","lopdf"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-16T19:55:39.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}