CVE-2026-102998: pypdf: Possible long runtimes when generating appearance streams

Q: Which applications are exposed to this issue?

Applications using pypdf versions before 6.19.0 are exposed when they update form fields with flattening enabled and process a crafted PDF containing form field values. The impact is excessive runtime that can make the application unavailable.

Q: Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required. An attacker needs a crafted PDF to reach an application workflow that updates fields with flattening enabled.

Q: What should be done to remediate the issue?

Upgrade pypdf to version 6.19.0, which fixes the issue. If upgrading cannot happen immediately, avoid or restrict processing of untrusted PDFs in workflows that update form fields with flattening enabled.

Published Sep 30, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/appearancestream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0.

Affected Software

1 affected component

pypi/pypdf<6.19.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.19.0

Event History

Sep 30, 2026

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using pypdf versions before 6.19.0 are exposed when they update form fields with flattening enabled and process a crafted PDF containing form field values. The impact is excessive runtime that can make the application unavailable.

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required. An attacker needs a crafted PDF to reach an application workflow that updates fields with flattening enabled.

What should be done to remediate the issue?

Upgrade pypdf to version 6.19.0, which fixes the issue. If upgrading cannot happen immediately, avoid or restrict processing of untrusted PDFs in workflows that update form fields with flattening enabled.

CVE-2026-102998: pypdf: Possible long runtimes when generating appearance streams

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

Does exploitation require authentication or user interaction?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

Does exploitation require authentication or user interaction?

What should be done to remediate the issue?