CVE-2026-102997

Summary

A crafted PDF file can trigger inefficient byte-by-byte decompression in pypdf, leading to excessive CPU usage and application unavailability. This vulnerability allows attackers to perform a denial-of-service attack by submitting malicious PDF files.

Exploitability

Exploitation is relatively straightforward as it requires only uploading or processing a specially crafted PDF file with malformed FlateDecode streams, with no additional authentication or complex preconditions needed.

Blast radius

The impact could be significant in environments where pypdf is used to process untrusted PDF files, potentially causing widespread service disruption across applications that rely on this library for PDF handling.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to pypdf version 6.18.1 or later to remediate this denial-of-service vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.