Problem

A new high-severity advisory — RUSTSEC-2026-0187 (CVSS 7.5, published 2026-06-21) — reports a stack overflow in lopdf when parsing deeply nested PDF objects.

lopdf 0.38.0 reaches us transitively through pdf-extract 0.10.0, a direct dependency of librefang-channels and librefang-runtime. pdf-extract 0.10 pins lopdf ^0.38, so the fixed lopdf >= 0.42.0 is unreachable without bumping pdf-extract itself.

This made the Security CI job (cargo audit) fail repo-wide on every PR (exit 1) — the advisory is not in the ci.yml --ignore allowlist. It is currently blocking #6338 (and would block any PR / the next release).

Why it's attacker-reachable

Both crates feed user-supplied PDF attachment bytes straight into pdf_extract::extract_text_from_mem:

• crates/librefang-channels/src/attachment_enrich.rs
• crates/librefang-runtime/src/pdf_text.rs

A crafted PDF can drive the overflow. The existing catch_unwind guards at both sites do not mitigate this: a stack overflow aborts the process rather than unwinding, so catch_unwind never runs. The dependency upgrade is the real fix, not a defense-in-depth nicety.

Fix

Bump pdf-extract 0.10 → 0.12 in both crates and regenerate Cargo.lock. pdf-extract 0.12.0 (published 2026-06-25) requires lopdf ^0.42, pulling the patched lopdf 0.42.0.

Lockfile delta (minimal):

• lopdf 0.38.0 → 0.42.0 (the fix)
• pdf-extract 0.10.0 → 0.12.0
• cff-parser 0.1.0 → 0.2.0
• drops bytecount, nom_locate (no longer in the tree)

The only pdf-extract API used — extract_text_from_mem(&[u8]) -> Result<String, _> — is unchanged across the bump; both call sites already treat the error via Display, so no source changes are needed.

Changed files

• crates/librefang-channels/Cargo.toml — pdf-extract = "0.12"
• crates/librefang-runtime/Cargo.toml — pdf-extract = "0.12"
• Cargo.lock — regenerated via cargo update -p pdf-extract --precise 0.12.0
• CHANGELOG.md — [Unreleased] → ### Fixed entry

Verification

• cargo audit no longer flags RUSTSEC-2026-0187 once lopdf 0.42.0 is in the lock (verify via the Security CI job on this PR going green).
• Compile verification is left to CI (Test / Unit (lib+bin) + build lanes) per the repo's "no local cargo build" rule; the API surface touched is a single unchanged function.

Out-of-scope note (not touched here)

The existing ## [Unreleased] section in CHANGELOG.md sits below the already-released ## [2026.6.26] section and re-lists several PRs (#6312, #6315, #6316, #6330) that also appear under 2026.6.26 — a pre-existing release-tooling artifact, not introduced by this PR. Left as-is to keep this change scoped; flagging for a maintainer.