RUSTSEC-2026-0187: Stack overflow in lopdf via deeply nested PDF objects

What to do

1. See which version you have: cargo tree -i lopdf (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p lopdf. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example lopdf = "0.42.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

lopdf::Document::load_mem (and the other load* entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT.

Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.

Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.

Proof of concept

fn main() {
    let bytes = std::fs::read("poc.pdf").unwrap(); // ~10,380-deep nested array in the Catalog
    let _ = lopdf::Document::load_mem(&bytes);     // stack overflow -> SIGABRT
}

An equivalent PoC is a minimal PDF whose Catalog /X value is "[" * 10380 + "]" * 10380.

Suggested fix

Enforce a maximum object-nesting depth in the parser and return an Err instead of recursing without bound.

References

• Package: crates.io/crates/lopdf
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0187.html
• Report: github.com/J-F-Liu/lopdf/issues/502
• Web: github.com/J-F-Liu/lopdf/pull/503
• Web: github.com/J-F-Liu/lopdf/commit/c755394

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.