CVE-2026-102999: py-pdf pypdf Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-102999 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in py-pdf pypdf. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.5% of scored vulnerabilities.
Timeline
- 30-09-2026PublishedVulnerability first disclosed.
- 01-10-2026Last modifiedVulnerability information updated.
Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Affected systems
Ubuntu2 products
- pypdfAll versions (No fix recorded)
- pypdf2All versions (No fix recorded)
Chainguard1 product
- open-webui< 0.11.4-r3
Debian1 product
- pypdfAll versions (No fix recorded) | < 6.19.0-1
Py-pdf1 product
- pypdf< 6.19.0
Pypdf_project1 product
- pypdf< 6.19.0
PyPI1 product
- pypdf< 6.19.0
Wolfi1 product
- open-webui< 0.11.4-r3
7 vendors · 8 products
References
11 links- github.com/py-pdf/pypdf/security/advisories/GHSA-v247-6f48-mgcjX Refsource CONFIRMWEBREPORTVendor Advisory
- github.com/py-pdf/pypdf/commit/6b10556d13609a68f9ed18bb29fdd8bba88eb2c3X Refsource MISCWEBREPORTPatch
- github.com/py-pdf/pypdfPACKAGE
- pypi.org/project/pypdfPACKAGE
