CVE-2026-102994: pypdf: Possible long runtimes/large memory usage when parsing indirect objects
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace.
Patches
This has been fixed in pypdf==6.18.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4055.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through readuntilwhitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.18.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.18.0 - Compensating control
If upgrading is not yet possible, apply the changes from PR #4055.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using pypdf versions earlier than 6.18.0 are affected when they parse a crafted PDF. The issue can make the application unavailable through excessive runtime or memory consumption.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network attack access, low complexity, no privileges required, and no user interaction.
What is the recommended remediation?
Upgrade pypdf to version 6.18.0, which fixes the excessive scanning behavior in indirect-object identifiers and generation-number tokens.
What can be done if an upgrade cannot happen immediately?
The provided information identifies crafted PDFs as the trigger, so limit or avoid processing untrusted PDFs until pypdf can be upgraded. The data does not provide a more specific configuration workaround.