GHSA-6fj4-rcr3-r7rr: Lopdf Lopdf Has A Stack Overflow Vulnerability

HIGH
Share
CVSS 7.5
CWE-1124
Published
Advisory Summary

GHSA-6fj4-rcr3-r7rr is a HIGH (CVSS 7.5) lopdf has a stack overflow vulnerability (CWE-1124: Excessively Deep Nesting) affecting Lopdf libraries in the crates.io ecosystem. The issue involves lopdf has a stack overflow via deeply nested pdf objects. Remediation is available by upgrading affected packages to version 0.42.0.

GHSA-6fj4-rcr3-r7rr at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-6fj4-rcr3-r7rr
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification CWE-1124: Excessively Deep Nesting
Affected Product Lopdf
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix GHSA-6fj4-rcr3-r7rr

To remediate this vulnerability, upgrade all affected Lopdf dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

lopdf fixed: 0.42.0 
Upgrade lopdf to 0.42.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for lopdf

How to Check if You Are Affected

To determine whether your application is affected by GHSA-6fj4-rcr3-r7rr, inspect your project dependencies for Lopdf:

inspect dependencies for lopdf

Analyze the terminal output to locate any version of Lopdf in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.42.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1124: Excessively Deep Nesting, where the code contains a callable or other code grouping in which the nesting / branching is too deep. In Lopdf, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`. Because this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service. Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed. ## Proof of concept ```rust fn main() { let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog let _ = lopdf::Document::load_mem(&bytes); // stack overflow -> SIGABRT } ``` An equivalent PoC is a minimal PDF whose Catalog `/X` value is `"[" * 10380 + "]" * 10380`. ## Suggested fix Enforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.

GHSA-6fj4-rcr3-r7rr Affected Lopdf Versions

1 component(s)
Fixed Versions:
0.42.0
Product / Package Ecosystem Affected Versions Fixed Version
lopdf
 crates.io
< 0.42.0
0.42.0

References

Lopdf Source Repository REPOSITORY
https://github.com/J-F-Liu/lopdf/issues/502
Lopdf Source Repository REPOSITORY
https://github.com/J-F-Liu/lopdf/pull/503
Security Fix Commit FIX COMMIT
https://github.com/J-F-Liu/lopdf/commit/c755394ad7dd651ccfe77c618f90ab779da1dfd9
Lopdf Source Repository REPOSITORY
https://github.com/J-F-Liu/lopdf
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2026-0187.html

Frequently Asked Questions

What is GHSA-6fj4-rcr3-r7rr?
GHSA-6fj4-rcr3-r7rr is a security vulnerability in Lopdf involving lopdf has a stack overflow via deeply nested PDF objects under CWE-1124: Excessively Deep Nesting.
Which Lopdf versions are affected?
Affected versions include releases prior to 0.42.0 across affected packages: lopdf.
What version fixes GHSA-6fj4-rcr3-r7rr?
Upgrading to 0.42.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is lopdf affected?
Yes, lopdf is affected in releases prior to 0.42.0. Upgrade your dependency to 0.42.0 or later.
What is the CVSS score of GHSA-6fj4-rcr3-r7rr?
GHSA-6fj4-rcr3-r7rr has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with GHSA-6fj4-rcr3-r7rr?
GHSA-6fj4-rcr3-r7rr is classified under CWE-1124: Excessively Deep Nesting (The code contains a callable or other code grouping in which the nesting / branching is too deep.).
How can I check crates.io dependencies for GHSA-6fj4-rcr3-r7rr?
Run the dependency tree command: 'inspect dependencies for lopdf'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6fj4-rcr3-r7rr",
  "modified" : "2026-10-16T19:55:39Z",
  "published" : "2026-10-16T19:55:39Z",
  "aliases" : [ ],
  "summary" : "lopdf has a stack overflow via deeply nested PDF objects",
  "details" : "`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with `SIGABRT`.\n\nBecause this is a stack-overflow abort rather than a `panic!`, it cannot be caught with `catch_unwind`: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.\n\nConfirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.\n\n## Proof of concept\n\n```rust\nfn main() {\n    let bytes = std::fs::read(\"poc.pdf\").unwrap(); // ~10,380-deep nested array in the Catalog\n    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT\n}\n```\n\nAn equivalent PoC is a minimal PDF whose Catalog `/X` value is `\"[\" * 10380 + \"]\" * 10380`.\n\n## Suggested fix\n\nEnforce a maximum object-nesting depth in the parser and return an `Err` instead of recursing without bound.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "lopdf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.42.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/J-F-Liu/lopdf/issues/502"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/J-F-Liu/lopdf/pull/503"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/J-F-Liu/lopdf/commit/c755394ad7dd651ccfe77c618f90ab779da1dfd9"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/J-F-Liu/lopdf"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2026-0187.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1124" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-10-16T19:55:39Z",
    "nvd_published_at" : null
  }
}