CVE-2026-38970

The pdfcpu tool (versions through v0.11.1 ) is vulnerable to an uncontrolled-recursion denial-of-service (DoS) issue located in pkg/pdfcpu/model/parse.go. The root cause is that the parser recursively descends through nested PDF objects, such as arrays, via the ParseObjectContext() and parseArray...