Threat Intelligence / CVE / CVE-2026-38970
CVE-2026-38970
As of 2026-07-02, CVE-2026-38970 is a vulnerability. EPSS exploitation probability 0.2%. Threadlinqs Intelligence tracks 0 threats exploiting it.
Last updated: 2026-07-02
pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.
References
- https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L325-L366
- https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L942-L970
- https://github.com/pdfcpu/pdfcpu
Full detection coverage & IOCs for threats exploiting CVE-2026-38970 are available via the Threadlinqs MCP server (Purple tier). View plans →
← all vulnerabilities · Markdown version · Threadlinqs Intelligence
Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.