GHSA-XG43-5579-QW6V

adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

adawolfa/isdoc reads ISDOC invoices from ISDOCX (ZIP) archives and from PDF files with embedded ISDOC documents and supplements. Affected versions inflate ZIP entries and read embedded files without validating their uncompressed size, so a small crafted file can amplify into gigabytes:

• ISDOCX decompression bomb, getFromName() inflates the ISDOC document and binary supplements with no size cap.
• saveTo() disk-fill, the supplement copy loop writes inflated bytes to disk with no running byte budget, so a bomb can exhaust disk even if the central-directory size is under-reported.
• PDF embedded files, an embedded file whose declared Length is enormous is read and digested with no upper bound.

Exploitation requires the application to parse an attacker-supplied .isdocx or .pdf (the typical use is generating files or parsing files from trusted vendors, so a user must be induced to process a malicious file). When that happens the process can be driven to exhaust memory or disk, causing denial of service. There is no confidentiality or integrity impact, availability only.

Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.

GHSA-XG43-5579-QW6V has a CVSS score of 6.5 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.6.1, 1.5.1, 1.4.3); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Fixed in 1.4.3, 1.5.1, 1.6.1 and 2.0.0. The readers now:

• read the uncompressed size from the ZIP central directory (statName()) and reject entries over a cap before inflating, 256 KB (DocumentSizeLimit) for the ISDOC document, 32 MB (SizeLimit) for supplements;
• enforce a running byte budget in saveTo() and unlink the partial file on overflow;
• reject PDF-embedded files whose declared Length exceeds 256 MB before reading or digesting them.

New exceptions ReaderException::zipEntryTooLarge(), SupplementException::supplementTooLarge() and ReaderException::pdfSupplementTooLarge() surface the rejection.

1. What is GHSA-XG43-5579-QW6V? GHSA-XG43-5579-QW6V is a medium-severity uncontrolled resource consumption vulnerability in adawolfa/isdoc (composer), affecting versions >= 1.6.0, < 1.6.1. It is fixed in 1.6.1, 1.5.1, 1.4.3. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
2. How severe is GHSA-XG43-5579-QW6V? GHSA-XG43-5579-QW6V has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of adawolfa/isdoc are affected by GHSA-XG43-5579-QW6V? adawolfa/isdoc (composer) versions >= 1.6.0, < 1.6.1 is affected.
4. Is there a fix for GHSA-XG43-5579-QW6V? Yes. GHSA-XG43-5579-QW6V is fixed in 1.6.1, 1.5.1, 1.4.3. Upgrade to this version or later.
5. Is GHSA-XG43-5579-QW6V exploitable, and should I be worried? Whether GHSA-XG43-5579-QW6V is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-XG43-5579-QW6V is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-XG43-5579-QW6V?
   • Upgrade adawolfa/isdoc to 1.6.1 or later
   • Upgrade adawolfa/isdoc to 1.5.1 or later
   • Upgrade adawolfa/isdoc to 1.4.3 or later