Add advisory for lopdf: stack overflow via deeply nested PDF objects

[joszamama]

Affected crate(s)

• lopdf (5,196,354 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• Stack overflow (DoS) parsing deeply nested PDF objects J-F-Liu/lopdf#502

Severity

Remote denial-of-service via stack exhaustion. Document::load_mem recurses without bound on nested PDF arrays/dictionaries; a ~21 KB PDF whose Catalog contains a ~10,380-deep nested array overflows the stack and aborts the process (SIGABRT) on lopdf 0.41.0. The abort is not catchable with catch_unwind, so any service parsing untrusted PDFs can be crashed.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

Why did you not use the pull request template? Did you report this upstream? If you did so privately, why are you disclosing the issue through this PR?

[joszamama]

1. Template: I opened this via the CLI and bypassed the template by accident. I've updated the description to follow it (affected crate, upstream link, severity, checklist).

2. Upstream: I had not reported it upstream before opening the PR. (I am quite new to this process; I know it is not an excuse, but I misunderstood it) I've now filed an upstream issue and asked the maintainer whether publishing an advisory is appropriate: Stack overflow (DoS) parsing deeply nested PDF objects J-F-Liu/lopdf#502. The repo has no security policy, and private vulnerability reporting is disabled, so I used a public issue.

3. I've converted this PR to a draft and will mark it ready once the maintainer has had a chance to weigh in (or after a reasonable window if there's no response). If you'd rather I close it and reopen after upstream coordination, I'm happy to.

[joszamama]

The upstream fix (#503, commit c755394) is merged to main but not yet released to crates.io.