CVE-2026-38970

Received Received - Intake

Uncontrolled Recursion DoS in pdfcpu

Publication date: 2026-07-02

Last updated on: 2026-07-02

Assigner: MITRE

Description

pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-02

Last Modified

2026-07-02

Generated

2026-07-03

AI Q&A

2026-07-03

EPSS Evaluated

N/A

NVD

CVE-2026-38970

Affected Vendors & Products

Vendor	Product	Version / Range
pdfcpu	pdfcpu	to 0.11.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in pdfcpu through version 0.11.1 and is an uncontrolled-recursion denial-of-service issue located in the file pkg/pdfcpu/model/parse.go.

The problem occurs because the PDF parser recursively processes nested PDF objects, including arrays, using the functions ParseObjectContext() and parseArray() without limiting the maximum depth of nesting.

As a result, deeply nested PDF objects can cause the parser to recurse indefinitely or excessively, leading to a denial-of-service condition.

Impact Analysis

This vulnerability can impact you by causing a denial-of-service (DoS) condition when processing maliciously crafted PDF files with deeply nested objects.

An attacker could exploit this issue to crash or hang applications using vulnerable versions of pdfcpu, potentially disrupting services or workflows that rely on PDF processing.

Hi! I’m here to help you understand CVE-2026-38970. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70