lopdf has a stack overflow via deeply nested PDF objects

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

GHSA-6fj4-rcr3-r7rr

RUSTSEC-2026-0187

osv · GHSA-6fj4-rcr3-r7rr

• https://github.com/J-F-Liu/lopdf/issues/502
• https://github.com/J-F-Liu/lopdf/pull/503
• https://github.com/J-F-Liu/lopdf/commit/c755394ad7dd651ccfe77c618f90ab779da1dfd9
• https://github.com/J-F-Liu/lopdf
• https://rustsec.org/advisories/RUSTSEC-2026-0187.html

osv · RUSTSEC-2026-0187

• https://crates.io/crates/lopdf
• https://rustsec.org/advisories/RUSTSEC-2026-0187.html
• https://github.com/J-F-Liu/lopdf/issues/502
• https://github.com/J-F-Liu/lopdf/pull/503
• https://github.com/J-F-Liu/lopdf/commit/c755394

No related operational record is retained in the current change model.