Summary
cargo audit reports a vulnerability in the locked lopdf dependency:
RUSTSEC-2026-0187 (stack overflow when parsing deeply nested PDF
objects, CVSS 7.5). Cargo.lock on main pins lopdf 0.41.0, which is
within the affected range; the advisory is fixed in lopdf >= 0.42.0.
Affected dependency chain
lopdf 0.41.0 (locked in Cargo.lock)- pulled in by
pdf-inspector 0.1.7, which is used by the anydoc
document-reading path (pdf-inspector declares lopdf and resolves
the vulnerable version)
Reproduction (from a clean checkout)
git clone the repository and check out main.- Run
cargo audit (or cargo deny check advisories).
- Observed:
error[vulnerability]: Stack overflow in lopdf via deeply nested PDF objects / lopdf 0.41.0 — exit code 1.
Suggested fix
Upgrade pdf-inspector from 0.1.7 to 0.1.8, which raises its lopdf
requirement to >= 0.42.0 and resolves the advisory. No application
source changes are needed. I have a patch ready and will open a PR
referencing this issue.
Summary
cargo auditreports a vulnerability in the lockedlopdfdependency:RUSTSEC-2026-0187 (stack overflow when parsing deeply nested PDF
objects, CVSS 7.5).
Cargo.lockonmainpinslopdf0.41.0, which iswithin the affected range; the advisory is fixed in
lopdf>= 0.42.0.Affected dependency chain
lopdf 0.41.0(locked inCargo.lock)pdf-inspector 0.1.7, which is used by the anydocdocument-reading path (
pdf-inspectordeclareslopdfand resolvesthe vulnerable version)
Reproduction (from a clean checkout)
git clonethe repository and check outmain.cargo audit(orcargo deny check advisories).error[vulnerability]: Stack overflow in lopdf via deeply nested PDF objects / lopdf 0.41.0— exit code 1.Suggested fix
Upgrade
pdf-inspectorfrom 0.1.7 to 0.1.8, which raises itslopdfrequirement to >= 0.42.0 and resolves the advisory. No application
source changes are needed. I have a patch ready and will open a PR
referencing this issue.