GO-2026-5781 Uncatchable stack-overflow denial of service in rsc.io/pdf
Attackers can crash services parsing untrusted PDFs using rsc.io/pdf by sending deeply nested documents that cause uncatchable stack overflows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GO-2026-5781?
GO-2026-5781 is a denial of service vulnerability in rsc.io/pdf, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Which versions are affected by GO-2026-5781?
1 open source package ship an affected version, including rsc.io/pdf.
| Package | Affected | Fixed in |
|---|---|---|
rsc.io/pdf Go | All versions | None |
How do I fix GO-2026-5781?
No fix has been published for GO-2026-5781 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GO-2026-5781 being exploited?
There is no known exploitation of GO-2026-5781 in the wild and no public exploit code.