lopdf has a stack overflow via deeply nested PDF objects

The lopdf library's Document::load_mem function and related entry points parse nested PDF arrays and dictionaries using recursion without a limit on nesting depth. A maliciously crafted PDF with approximately 10,000 nested array levels in the Catalog's /X entry causes the parser to exhaust the call stack, triggering a SIGABRT and crashing the process. This stack overflow results in a denial of service against applications using lopdf to parse untrusted PDF input. The vulnerability affects lopdf versions before 0.42.0 and is resolved by introducing a maximum nesting depth limit in the parser to prevent unbounded recursion.

An attacker can cause a denial of service by submitting a small (~21 KB) crafted PDF file with deeply nested arrays, crashing any service that uses lopdf versions prior to 0.42.0 for PDF parsing. There is no impact on confidentiality or integrity, only availability is affected.

A fix is available in lopdf version 0.42.0 which enforces a maximum object-nesting depth in the PDF parser to prevent unbounded recursion and stack overflow. Users should upgrade to version 0.42.0 or later to remediate this vulnerability.