CVE-2026-102999: pypdf: Possible long runtimes with large amount of embedded files

Q: Which applications are exposed to this issue?

Applications using pypdf before 6.19.0 are exposed when they access the dictionary-based embedded-file attachments API on attacker-controlled or otherwise untrusted PDFs containing many embedded files.

Q: What does an attacker need to do to trigger the problem?

An attacker needs to provide a crafted PDF with a large number of embedded files and cause the application to access the embedded-file mapping. No privileges or user interaction are required according to the supplied CVSS vector.

Q: What is the impact of successful exploitation?

Repeated reparsing of the full attachment list for each content lookup can cause long runtimes. The supplied CVSS vector identifies availability impact and does not identify confidentiality or integrity impact.

Q: What is the recommended remediation?

Upgrade pypdf to version 6.19.0, which fixes the repeated-work behavior in the dictionary-based attachments API.

Published Sep 30, 2026

Updated

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/doccommon.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.

Affected Software

1 affected component

pypi/pypdf<6.19.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.19.0

Event History

Sep 30, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using pypdf before 6.19.0 are exposed when they access the dictionary-based embedded-file attachments API on attacker-controlled or otherwise untrusted PDFs containing many embedded files.

What does an attacker need to do to trigger the problem?

An attacker needs to provide a crafted PDF with a large number of embedded files and cause the application to access the embedded-file mapping. No privileges or user interaction are required according to the supplied CVSS vector.

What is the impact of successful exploitation?

Repeated reparsing of the full attachment list for each content lookup can cause long runtimes. The supplied CVSS vector identifies availability impact and does not identify confidentiality or integrity impact.

What is the recommended remediation?

Upgrade pypdf to version 6.19.0, which fixes the repeated-work behavior in the dictionary-based attachments API.

CVE-2026-102999: pypdf: Possible long runtimes with large amount of embedded files

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to do to trigger the problem?

What is the impact of successful exploitation?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to do to trigger the problem?

What is the impact of successful exploitation?

What is the recommended remediation?