Denial of Service Vulnerability in pypdf

The pypdf library is susceptible to a denial-of-service condition identified as CVE-2026-102999. This vulnerability stems from inefficient handling of embedded files within PDF documents. When an application uses the library's dictionary-based API to access embedded files, a specially crafted PDF containing a large number of these objects can trigger a performance degradation, resulting in excessively long runtimes and potential service exhaustion. This issue affects all versions of pypdf prior to 6.19.0. Organizations processing untrusted or user-supplied PDF documents using this library are at risk of resource depletion attacks targeting their document processing pipelines.

Impact

Successful exploitation results in a denial-of-service condition where the application becomes unresponsive due to the excessive computational load required to process the malicious PDF. This impacts any system or automated service that parses, extracts, or inspects embedded content from PDF files using affected versions of pypdf.

Recommendation

Prioritized actions for development and security teams:

• Upgrade the pypdf dependency to version 6.19.0 or later to include the fix for CVE-2026-102999.
• If upgrading is not immediately feasible, apply the patches provided in PR #4081 to mitigate the excessive runtime behavior.
• Implement resource limits, such as execution timeouts or CPU usage quotas, for processes that invoke pypdf on untrusted input files.