CVE-2026-124553

BabelDOC font parsing could exhaust a translation worker

funstory-ai · BabelDOC PDF translation pipeline

First documented disclosure · Review checkpoint

Summary

Large character ranges in a PDF font map could consume a BabelDOC worker’s CPU or memory.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The researcher documented parser-level tests. The advisory reports no malicious exploitation or victim deployment.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Two Python parsers expanded character ranges without a practical resource bound. Version 0.7.0 replaces those parser paths.

Conditions required

An affected translation deployment must process a PDF containing an untrusted font character map. Public testing exercised the parsers directly.

Potential impact

Parser resource exhaustion can stall or terminate a worker. Service-wide impact depends on isolation and resource limits.

Affected versions and configurations

The CNA lists 0.3.61 up to 0.7.0, exclusive. The researcher tested 0.6.4.

Fix and mitigation status

0.7.0.

Practical next steps

Upgrade to 0.7.0. Where an upgrade must wait, isolate the parser in a worker with CPU and memory limits and a timeout.

Operating lesson

Apply resource bounds to document parsing before translation starts.

Evidence and limits

The direct parser tests did not execute an end-to-end PDF translation. The upstream CVSS 3.1 score is 7.5. The CNA also assigns CVSS 4.0 at 8.7.

Sources