CVE-2026-102994

Summary

The pypdf library suffers from a denial-of-service vulnerability where specially crafted PDF files can cause excessive CPU and memory consumption during parsing, leading to application unavailability. This occurs when PDF files contain long sequences of indirect-object identifiers or generation numbers without whitespace, causing the parser to scan indefinitely.

Exploitability

Exploitation is relatively straightforward as it requires only sending a malformed PDF file to a vulnerable pypdf-based application, with no additional preconditions needed.

Blast radius

The impact could be significant across any application that processes PDF files using pypdf versions prior to 6.18.0, potentially causing widespread service disruption in document processing systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to pypdf version 6.18.0 or later to remediate this denial-of-service vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.