CVE-2026-102999

Received Received - Intake

Denial of Service in pypdf via Embedded Files

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102999

EUVD

EUVD-2026-90272

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	6.19.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability is in pypdf, a Python PDF library. A crafted PDF with many embedded files causes the dictionary-based attachments API to repeatedly reprocess the full attachment list for each lookup. This leads to excessive computational work and slow performance when accessing embedded-file mappings.

Detection Guidance

Detecting this vulnerability requires checking the version of pypdf installed in your Python environment. Run 'pip show pypdf' or 'pip list | grep pypdf' to check the installed version. If it is below 6.19.0, the system is vulnerable.

Impact Analysis

An attacker could exploit this by providing a malicious PDF with many embedded files. This would cause applications using vulnerable pypdf versions to slow down significantly or become unresponsive when processing the PDF, potentially leading to denial-of-service conditions.

Mitigation Strategies

Upgrade pypdf to version 6.19.0 or later immediately using 'pip install --upgrade pypdf'. If upgrading is not possible, avoid processing untrusted PDF files with embedded attachments until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-102999. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70