CVE-2026-102999

Summary

The pypdf library suffers from a denial-of-service vulnerability where crafted PDF files with many embedded files can cause excessive CPU usage and slow processing times due to repeated reparsing of attachment lists. This affects applications that access embedded file mappings in PDFs.

Exploitability

Exploitation is moderately difficult as it requires crafting a specific PDF with many embedded files and having an application process it, but the attack can be automated through PDF generation tools.

Blast radius

The impact could affect any application using pypdf to process PDFs with embedded files, potentially causing service unavailability or performance degradation across multiple systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to pypdf version 6.19.0 or later to fix the issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.