CVE-2026-102998

Summary

A denial-of-service vulnerability in pypdf allows attackers to craft malicious PDF files that cause excessive CPU usage and application unavailability when form fields are updated with flattening enabled. This affects applications using pypdf for PDF processing.

Exploitability

Exploitation is relatively straightforward as it requires only crafting a malicious PDF file with specific form field values, with no additional prerequisites needed beyond having an application that uses pypdf with flattening enabled.

Blast radius

The vulnerability could impact any application that processes PDFs with form fields and uses pypdf version prior to 6.19.0, potentially causing widespread service unavailability when processing malicious PDFs.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to pypdf version 6.19.0 or later to remediate this denial-of-service vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.