BabelDOC: Resource exhaustion vulnerability in PDF translation (CVE-2026-124553)

BabelDOC versions 0.3.61 to 0.6.x are susceptible to a resource exhaustion vulnerability (CVE-2026-124553). Remote attackers can trigger this condition by submitting a crafted PDF document with embedded ToUnicode CMaps containing unbounded bfrange and cidrange spans. Processing these spans forces the translation worker to perform billions of iterations, leading to high CPU usage, memory depletion, and denial of service.

Impact

Successful exploitation results in a denial of service for the translation service by exhausting system resources (CPU and memory), rendering the application unresponsive to legitimate requests.

Recommendation

Upgrade BabelDOC to version 0.7.0 or later immediately to include the patch addressing CMap iteration bounds. If patching is not immediately feasible, implement input validation or file size/complexity limits for PDF uploads to identify and reject documents containing oversized or abnormal CMap definitions before passing them to the translation worker.