pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://github.com/pdfcpu/pdfcpu cve-icon
https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L325-L366 cve-icon
https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L942-L970 cve-icon
History

Fri, 17 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Leading to Denial of Service in pdfcpu PDF Parser

Wed, 15 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Leading to Denial of Service in pdfcpu PDF Parser

Tue, 14 Jul 2026 18:00:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Denial of Service in pdfcpu Parser

Mon, 13 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Denial of Service in pdfcpu Parser

Sun, 12 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title pdfcpu Recursion‑Depth Denial of Service in PDF Parsing

Sat, 11 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title pdfcpu Recursion‑Depth Denial of Service in PDF Parsing

Fri, 10 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser

Thu, 09 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser

Thu, 09 Jul 2026 06:00:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion PDF Parser

Wed, 08 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion PDF Parser

Tue, 07 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion in pdfcpu Parser Causes Denial of Service

Mon, 06 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion in pdfcpu Parser Causes Denial of Service

Mon, 06 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-674
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursive Parsing Causes Denial‑of‑Service in pdfcpu
Weaknesses CWE-119
CWE-123

Mon, 06 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursive Parsing Causes Denial‑of‑Service in pdfcpu
Weaknesses CWE-119
CWE-123

Sun, 05 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser
Weaknesses CWE-674
CWE-770

Sat, 04 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Denial of Service in pdfcpu PDF Parser
Weaknesses CWE-674
CWE-770

Sat, 04 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion in pdfcpu PDF Parser Causes Denial of Service
Weaknesses CWE-674

Fri, 03 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion in pdfcpu PDF Parser Causes Denial of Service
Weaknesses CWE-674

Fri, 03 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Leading to Denial of Service in pdfcpu PDF Parser
Weaknesses CWE-749

Fri, 03 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Uncontrolled Recursion Leading to Denial of Service in pdfcpu PDF Parser
Weaknesses CWE-749

Thu, 02 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-07-02T00:00:00.000Z

Updated: 2026-07-06T14:44:12.877Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-38970

cve-icon Vulnrichment

Updated: 2026-07-06T14:43:55.609Z

cve-icon NVD

No data.

cve-icon Redhat

No data.