GO-2026-6115

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6115

Import Source

https://vuln.go.dev/ID/GO-2026-6115.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6115

Aliases

CVE-2026-56867

Withdrawn

2026-08-18T20:22:32Z

Published

2026-08-18T16:48:02Z

Modified

2026-08-19T17:30:23Z

Summary

WITHDRAWN: Multiple denial of service vulnerabilities in rsc.io/pdf and forks

Details

(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input:

Unchecked /Size, /Index, /W, and classic subsection header parameters in cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) panics.
Unterminated hexadecimal strings cause an infinite loop in readByte and readHexString.
Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines cause unbounded recursion leading to uncatchable stack overflow.
Various malformed constructs trigger runtime panics in NewReader and Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, odd-length UTF-16 strings, and newline buffer underflows).

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6115"
}

References

Credits

- Gage Marshall

Affected packages

Go / github.com/dslipak/pdf

Package

Name: github.com/dslipak/pdf; View open source insights on deps.dev
Purl: pkg:golang/github.com/dslipak/pdf

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dslipak/pdf",
            "symbols": [
                "NewReader",
                "NewReaderEncrypted",
                "Open",
                "Page.Content",
                "Reader.Page"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6115.json"

Go / github.com/ledongthuc/pdf

Package

Name: github.com/ledongthuc/pdf; View open source insights on deps.dev
Purl: pkg:golang/github.com/ledongthuc/pdf

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/ledongthuc/pdf",
            "symbols": [
                "NewReader",
                "NewReaderEncrypted",
                "Open",
                "Page.Content",
                "Page.GetTextByColumn",
                "Page.GetTextByRow",
                "Reader.GetPlainText",
                "Reader.GetStyledTexts",
                "Reader.Page"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6115.json"

Go / rsc.io/pdf

Package

Name: rsc.io/pdf; View open source insights on deps.dev
Purl: pkg:golang/rsc.io/pdf

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "rsc.io/pdf",
            "symbols": [
                "NewReader",
                "NewReaderEncrypted",
                "Open",
                "Page.Content",
                "Reader.Page"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6115.json"