CVE-2026-38970: pdfcpu Uncontrolled Recursion Denial-of-Service (CVSS 7.5)

Technical summary

CVE-2026-38970 is an uncontrolled-recursion denial-of-service vulnerability in pdfcpu's PDF parsing logic. The vulnerable code paths—ParseObjectContext() and parseArray() in pkg/pdfcpu/model/parse.go—lack maximum recursion depth enforcement when traversing nested PDF arrays and objects. A specially crafted PDF with deeply nested structures can trigger stack exhaustion or heap memory depletion, causing the parser to crash or hang. This flaw affects pdfcpu through v0.11.1 and is tracked under CWE-674 (Uncontrolled Recursion).

Business impact

Any service or application embedding pdfcpu to process user-supplied or untrusted PDF documents faces availability risk. A single malicious PDF upload could crash a batch processing service, web application, or document management system. Organizations operating PDF-as-a-service platforms, automated document workflows, or API endpoints that accept PDF files should prioritize assessment. Recovery typically requires service restart, and repeated attacks can disrupt business continuity.

Affected systems

pdfcpu v0.11.1 and earlier versions are vulnerable. Applications written in Go that depend on pdfcpu for PDF parsing are at risk. This includes web servers, batch processors, document conversion tools, and any microservice handling untrusted PDF input. The vendor product list has not been populated in the advisory; organizations should audit their own dependencies using package managers (go.mod, go.sum) and dependency scanning tools to identify internal or third-party use.

Exploitability

Exploitability is straightforward: an attacker needs only to craft a PDF with excessive object nesting and deliver it to a vulnerable parser. No authentication, special privileges, or user interaction is required—the CVSS vector indicates network accessibility (AV:N), low complexity (AC:L), and no authentication (PR:N). Public availability of exploit code or proof-of-concept files has not been confirmed, but the attack surface is broad for any public-facing PDF upload functionality.

Remediation

Upgrade pdfcpu to a patched version above v0.11.1 as soon as one is available. Until patching is possible, implement depth-limiting validation on PDF inputs: reject files where the nesting depth of arrays and objects exceeds a reasonable threshold (typically 20–50 levels, depending on legitimate use cases). Network-level controls such as file size limits and timeouts on parsing operations provide temporary mitigation but are not sufficient as primary fixes. Monitor for signs of exploitation (sudden CPU/memory spikes, service crashes).

Patch guidance

Check the official pdfcpu repository and release notes for versions after v0.11.1 that address this vulnerability. Update your go.mod dependency specification to require the patched version, run 'go get -u github.com/pdfcpu/pdfcpu@<patched-version>', and rebuild your application. Verify the patch in a staging environment before production rollout. Coordinate patching across all internal services and third-party products that embed pdfcpu.

Detection guidance

Monitor application logs and metrics for crashes or hangs during PDF parsing, especially if they coincide with unusual PDF submissions. Implement intrusion detection signatures that flag PDF uploads with excessive nesting depth (e.g., counting opening brackets in the file structure). Log parser errors and stack traces. In a detection lab, test your monitoring by feeding a proof-of-concept nested-PDF payload and confirming alerts fire. Use dynamic analysis or fuzzing to identify other potential recursion issues in PDF processing code.

Why prioritize this

This vulnerability scores CVSS 7.5 (HIGH) due to network accessibility, no authentication requirement, and high impact on availability. While confidentiality and integrity are not compromised, denial-of-service attacks disrupt service. Organizations with public-facing PDF intake should patch within 30 days; internal tools with restricted access may have slightly longer windows. The lack of KEV status and public exploit confirmation suggests exploits are not yet weaponized at scale, but the low barrier to crafting a malicious PDF means proactive patching is essential.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: Network-accessible attack vector (AV:N) with low complexity (AC:L), no authentication or user interaction required (PR:N, UI:N), and a scope that is unchanged (S:U). The impact is entirely on availability (A:H), with no confidentiality or integrity loss (C:N, I:N). This is a classic high-severity availability risk suitable for critical infrastructure and customer-facing services. The score does not account for compensating controls you may have in place (input validation, resource limits); assess your specific environment's risk accordingly.

Frequently asked questions