CVE-2026-102998

Received Received - Intake

Excessive CPU Usage in pypdf PDF Library

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102998

EUVD

EUVD-2026-90384

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.19.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the pypdf library, a Python tool for handling PDF files. A specially crafted PDF with form field values can cause the library to repeatedly process the same data in a loop when updating fields with flattening enabled. This leads to excessive runtime and makes the application unavailable.

Detection Guidance

Detecting this vulnerability requires checking the version of pypdf in use. Run 'pip show pypdf' or 'pip list | grep pypdf' to verify if the installed version is below 6.19.0. If so, the system is vulnerable.

Impact Analysis

If you use pypdf versions before 6.19.0, an attacker could exploit this flaw by providing a malicious PDF file. This could cause your application to hang or crash, disrupting normal operations and potentially leading to denial of service.

Mitigation Strategies

Upgrade pypdf to version 6.19.0 or later immediately using 'pip install --upgrade pypdf'. If upgrading is not possible, disable PDF form field flattening in applications using pypdf until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-102998. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70