CVE-2026-102994: py-pdf pypdf Uncontrolled Resource Consumption

Vulnerability summary

CVE-2026-102994 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in py-pdf pypdf. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.5% of scored vulnerabilities.

Timeline

1. 30-09-2026
   PublishedVulnerability first disclosed.
2. 30-09-2026
   Last modifiedVulnerability information updated.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.