lopdf

Version	Released
`0.46.0` minor	Oct 21, 2026
`0.45.0` minor	Sep 08, 2026
`0.44.0` unknown	Jul 10, 2026
`0.43.0` unknown	Jun 29, 2026
`0.42.0` unknown	Jun 24, 2026
`0.41.0` unknown 1 CVE	Jun 04, 2026
`0.40.0` unknown 1 CVE	Mar 19, 2026
`0.39.0` unknown 1 CVE	Jan 12, 2026
`0.38.0` unknown 1 CVE	Aug 31, 2025
`0.37.0` unknown 1 CVE	Aug 15, 2025
`0.36.0` unknown 1 CVE	Mar 15, 2025
`0.35.0` unknown 1 CVE	Jan 19, 2025
`0.34.0` unknown 1 CVE	Sep 01, 2024
`0.33.0` unknown 1 CVE	Jul 11, 2024
`0.32.0` unknown 1 CVE	Jan 16, 2024
`0.31.0` unknown 1 CVE	May 10, 2023
`0.30.0` unknown 1 CVE	Apr 09, 2023
`0.29.0` unknown 1 CVE	Oct 29, 2022
`0.28.0` unknown yanked 1 CVE	Jul 23, 2022
`0.27.0` unknown 1 CVE	Dec 16, 2021
`0.26.0` unknown 1 CVE	Sep 29, 2020
`0.25.0` unknown 1 CVE	Jun 25, 2020
`0.24.0` unknown 1 CVE	Feb 17, 2020
`0.23.0` unknown 1 CVE	Jul 14, 2019
`0.22.0` unknown 1 CVE	May 13, 2019
`0.21.0` unknown 1 CVE	Apr 26, 2019
`0.20.0` unknown 1 CVE	Mar 08, 2019
`0.19.0` unknown 1 CVE	Oct 24, 2018
`0.18.0` unknown 1 CVE	Oct 05, 2018
`0.17.0` unknown 1 CVE	Sep 19, 2018
`0.16.0` unknown 1 CVE	Sep 18, 2018
`0.15.3` unknown 1 CVE	Sep 14, 2018
`0.15.2` unknown 1 CVE	Jun 08, 2018
`0.15.1` unknown 1 CVE	Feb 04, 2018
`0.15.0` unknown 1 CVE	Feb 04, 2018
`0.14.2` unknown 1 CVE	Feb 02, 2018
`0.14.1` unknown 1 CVE	Nov 04, 2017
`0.14.0` unknown 1 CVE	Nov 03, 2017
`0.13.0` unknown 1 CVE	Oct 02, 2017
`0.12.0` unknown 1 CVE	Sep 05, 2017
`0.11.0` unknown 1 CVE	Aug 21, 2017
`0.10.0` unknown 1 CVE	Jul 20, 2017
`0.9.0` unknown 1 CVE	May 24, 2017
`0.8.0` unknown 1 CVE	Mar 16, 2017
`0.7.0` unknown 1 CVE	Mar 07, 2017
`0.6.0` unknown 1 CVE	Feb 16, 2017
`0.5.0` unknown 1 CVE	Feb 10, 2017
`0.4.1` unknown 1 CVE	Feb 03, 2017
`0.4.0` unknown 1 CVE	Jan 29, 2017
`0.3.2` unknown 1 CVE	Jan 24, 2017

0.46.0 minor

Oct 21, 2026

0.45.0 minor

Sep 08, 2026

0.44.0 unknown

Jul 10, 2026

0.43.0 unknown

Jun 29, 2026

0.42.0 unknown

Jun 24, 2026

0.41.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jun 04, 2026

0.40.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Mar 19, 2026

0.39.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jan 12, 2026

0.38.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Aug 31, 2025

0.37.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Aug 15, 2025

0.36.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Mar 15, 2025

0.35.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jan 19, 2025

0.34.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Sep 01, 2024

0.33.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jul 11, 2024

0.32.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jan 16, 2024

0.31.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

May 10, 2023

0.30.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Apr 09, 2023

0.29.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Oct 29, 2022

0.28.0 unknown yanked

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jul 23, 2022

0.27.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Dec 16, 2021

0.26.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Sep 29, 2020

0.25.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jun 25, 2020

0.24.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Feb 17, 2020

0.23.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jul 14, 2019

0.22.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

May 13, 2019

0.21.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Apr 26, 2019

0.20.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Mar 08, 2019

0.19.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Oct 24, 2018

0.18.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Oct 05, 2018

0.17.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Sep 19, 2018

0.16.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Sep 18, 2018

0.15.3 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Sep 14, 2018

0.15.2 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jun 08, 2018

0.15.1 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Feb 04, 2018

0.15.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Feb 04, 2018

0.14.2 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Feb 02, 2018

0.14.1 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Nov 04, 2017

0.14.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Nov 03, 2017

0.13.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Oct 02, 2017

0.12.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Sep 05, 2017

0.11.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Aug 21, 2017

0.10.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jul 20, 2017

0.9.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

May 24, 2017

0.8.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Mar 16, 2017

0.7.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Mar 07, 2017

0.6.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Feb 16, 2017

0.5.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Feb 10, 2017

0.4.1 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Feb 03, 2017

0.4.0 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jan 29, 2017

0.3.2 unknown

1 CVE

GHSA-6fj4-rcr3-r7rr RUSTSEC-2026-0187 Oct 16, 2026

lopdf has a stack overflow via deeply nested PDF objects

7.5 / 10

High

Network Low None None Unchanged None None High

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

Fixed in


          0.42.0

References

Updated Oct 17, 2026 · Source: OSV.dev

Jan 24, 2017

Activity

Reach

Details