CVE-2026-102997: py-pdf pypdf Uncontrolled Resource Consumption

Vulnerability summary

CVE-2026-102997 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in py-pdf pypdf. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.5% of scored vulnerabilities.

Timeline

1. 30-09-2026
   PublishedVulnerability first disclosed.
2. 02-10-2026
   Last modifiedVulnerability information updated.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.