CVE-2026-102999: pypdf: Possible long runtimes with large amount of embedded files
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API.
Patches
This has been fixed in pypdf==6.19.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4081.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/doccommon.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.19.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.19.0 - Compensating control
If upgrading is not yet possible, apply the changes from PR #4081.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using pypdf before 6.19.0 are exposed when they access the dictionary-based embedded-file attachments API on attacker-controlled or otherwise untrusted PDFs containing many embedded files.
What does an attacker need to do to trigger the problem?
An attacker needs to provide a crafted PDF with a large number of embedded files and cause the application to access the embedded-file mapping. No privileges or user interaction are required according to the supplied CVSS vector.
What is the impact of successful exploitation?
Repeated reparsing of the full attachment list for each content lookup can cause long runtimes. The supplied CVSS vector identifies availability impact and does not identify confidentiality or integrity impact.
What is the recommended remediation?
Upgrade pypdf to version 6.19.0, which fixes the repeated-work behavior in the dictionary-based attachments API.