Stack Exhaustion Vulnerability in lopdf Rust Library

The Rust library lopdf (versions prior to 0.42.0) contains a vulnerability in its document parsing logic within lopdf::Document::load_mem and related entry points. The parser recursively processes nested PDF arrays and dictionaries without implementing a depth limit. By supplying a specially crafted PDF file containing approximately 10,000 levels of nested objects (e.g., [[[[...]]]]), an attacker can trigger a stack overflow that results in a process-terminating SIGABRT.

Because this termination occurs as a non-recoverable abort rather than a standard Rust panic!, the crash cannot be intercepted by catch_unwind handlers. Any service that uses lopdf to process untrusted or user-supplied PDF input is susceptible to this denial-of-service (DoS) attack. The attack requires only a small file (approximately 21 KB) to crash the target application. This issue highlights the danger of unbounded recursion when handling complex file formats.

Impact

Successful exploitation results in a denial-of-service condition for the affected application or service. Any system utilizing lopdf to ingest user-uploaded files, process PDF documents from email attachments, or handle API-based PDF generation is at risk. Given that the crash is an unrecoverable SIGABRT, affected services will experience complete process interruption until restarted, potentially leading to significant downtime in environments that rely on automated PDF processing.

Recommendation

1. Update the lopdf dependency to version 0.42.0 or later, which implements a maximum object-nesting depth to prevent unbounded recursion.
2. Implement input validation at the application level to reject or pre-scan PDF files for excessive nesting depth before passing them to the lopdf parsing functions.
3. Where possible, run PDF parsing logic in a sandboxed or isolated process with resource limits to minimize the impact of crashes on core service infrastructure.