CVE-2026-102994: pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Q: Which deployments are exposed to this issue?

Applications using pypdf versions earlier than 6.18.0 are affected when they parse a crafted PDF. The issue can make the application unavailable through excessive runtime or memory consumption.

Q: Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network attack access, low complexity, no privileges required, and no user interaction.

Q: What is the recommended remediation?

Upgrade pypdf to version 6.18.0, which fixes the excessive scanning behavior in indirect-object identifiers and generation-number tokens.

Q: What can be done if an upgrade cannot happen immediately?

The provided information identifies crafted PDFs as the trigger, so limit or avoid processing untrusted PDFs until pypdf can be upgraded. The data does not provide a more specific configuration workaround.

Published Sep 30, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through readuntilwhitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.

Affected Software

1 affected component

pypi/pypdf<6.18.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.18.0

Event History

Sep 30, 2026

CVE Published

via MITRE·07:57 PM

Data Sourced

via MITRE·07:57 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using pypdf versions earlier than 6.18.0 are affected when they parse a crafted PDF. The issue can make the application unavailable through excessive runtime or memory consumption.

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network attack access, low complexity, no privileges required, and no user interaction.

What is the recommended remediation?

Upgrade pypdf to version 6.18.0, which fixes the excessive scanning behavior in indirect-object identifiers and generation-number tokens.

What can be done if an upgrade cannot happen immediately?

The provided information identifies crafted PDFs as the trigger, so limit or avoid processing untrusted PDFs until pypdf can be upgraded. The data does not provide a more specific configuration workaround.

CVE-2026-102994: pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the recommended remediation?

What can be done if an upgrade cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the recommended remediation?

What can be done if an upgrade cannot happen immediately?