Cpe:2.3:a:babeldoc:babeldoc:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ababeldocbabeldoc/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 17:30:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBabelDOC: Resource exhaustion vulnerability in PDF translation (CVE-2026-124553)https://feed.craftedsignal.io/briefs/2026-11-babeldoc-dos/Sun, 08 Nov 2026 17:30:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-babeldoc-dos/BabelDOC versions 0.3.61 through 0.6.x are vulnerable to remote denial-of-service via crafted PDF documents containing malicious ToUnicode CMap spans that cause excessive CPU and memory consumption.BabelDOC versions 0.3.61 to 0.6.x are susceptible to a resource exhaustion vulnerability (CVE-2026-124553). Remote attackers can trigger this condition by submitting a crafted PDF document with embedded ToUnicode CMaps containing unbounded bfrange and cidrange spans. Processing these spans forces the translation worker to perform billions of iterations, leading to high CPU usage, memory depletion, and denial of service.

Impact

Successful exploitation results in a denial of service for the translation service by exhausting system resources (CPU and memory), rendering the application unresponsive to legitimate requests.

Recommendation

Upgrade BabelDOC to version 0.7.0 or later immediately to include the patch addressing CMap iteration bounds. If patching is not immediately feasible, implement input validation or file size/complexity limits for PDF uploads to identify and reject documents containing oversized or abnormal CMap definitions before passing them to the translation worker.

]]>lowadvisory