AIKIDO-2025-10430

TL;DR

Affected versions of this package are vulnerable to an infinite loop when processing a corrupted PDF file containing malformed arrays. The lexer fails to properly handle cases where the array terminator ] is missing, causing it to loop indefinitely after exceeding the buffer length without triggering an error. An attacker could exploit this vulnerability by crafting a malicious PDF to induce a denial-of-service (DoS) condition, consuming excessive CPU resources. This exploit occurs because the lexer continues searching for the terminator even after the buffer bounds have been exceeded.