CVE-2026-33438: Stirling-PDF vulnerable to DoS via add-watermark
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Versions starting in 2.1.5 and prior to 2.5.2 have Denial of Service (DoS) vulnerability in the Stirling-PDF watermark functionality (/api/v1/security/add-watermark endpoint). The vulnerability allows authenticated users to cause resource exhaustion and server crashes by providing extreme values for the fontSize and widthSpacer parameters. Version 2.5.2 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33438?
CVE-2026-33438 has a high severity rating due to its potential to result in Denial of Service (DoS) attacks.
How do I fix CVE-2026-33438?
To fix CVE-2026-33438, upgrade Stirling-PDF to version 2.5.2 or later.
Which versions of Stirling-PDF are affected by CVE-2026-33438?
CVE-2026-33438 affects all Stirling-PDF versions starting from 2.1.5 up to, but not including, 2.5.2.
What kind of attacks can CVE-2026-33438 lead to?
CVE-2026-33438 can lead to Denial of Service (DoS) attacks, disrupting service availability.
Is there a known exploit for CVE-2026-33438?
Yes, the vulnerability in CVE-2026-33438 can be exploited through the add-watermark functionality.