Mitigation of Denial-of-Service vulnerabilities
This release introduces safeguards against potential denial-of-service attacks caused by specially crafted PDF files.
- Uncontrolled recursion: Added a configurable nesting depth limit to prevent excessive recursion when parsing deeply nested PDF objects.
- Unbounded decompression: Extended the existing decompression memory limit to additional filters (
LZWDecodeandRunLengthDecode). - Additional improvements: Added cycle detection for PDF page trees, regression tests, and updated configuration documentation.
Limitations and backward compatibility
To preserve backward compatibility, the default decompression limit remains 0 (unlimited). Applications processing untrusted PDFs should explicitly configure Config::setDecodeMemoryLimit().
The nesting depth limit defaults to 5,000 levels but does not currently cover recursion caused by consecutive PDF comments. These safeguards therefore mitigate, but do not completely eliminate, the reported risks.
Acknowledgments
Special thanks to Eduardo Santos de Abreu (@blackrose-0xday) for responsibly reporting both vulnerabilities and providing detailed proof-of-concept examples.
CVE identifiers will be added once available.
See #843 for further details.