What’s Vulnerable › Vulnerabilities

CVE-2026-38970

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-02 · updated 2026-08-21
• Weakness: CWE-674

Description

pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.

References

• https://github.com/pdfcpu/pdfcpu
• https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L325-L366
• https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L942-L970
• https://github.com/pdfcpu/pdfcpu/commit/9db810afb52b555ffcae955b32c0be3a73eb53d3
• https://github.com/pdfcpu/pdfcpu/releases/tag/v0.12.0

Get alerted when CVE-2026-38970 or the next vulnerability affects your stack