uc.surf Report a vulnerability

GoSeverity: MediumStatus: Published

Crafted /ByteRange with a negative length panics the fluent Verify().Valid() API (unrecovered makeslice panic, DoS)

A crafted /ByteRange with a negative length caused an unrecovered makeslice panic in the fluent Verify().Valid() API, so a malformed PDF could crash a service that verifies untrusted files (denial of service). Fixed in v1.0.0-rc5.

Timeline

  1. Found
  2. Reported via private vulnerability report
  3. Advisory published
  4. Entry last updated

Machine-readable: JSON · Markdown · ID security/go/digitorus__pdfsign/2026-10-06-fluent-verify-byterange-panic-dos