CVE-2026-102994 in pypdf
Summary
by MITRE • 09/30/2026
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in the pypdf library prior to version 6.18.0 represents a significant availability risk stemming from inefficient input parsing logic within the PDF processing engine. As an open-source Python library designed for reading, writing, and manipulating PDF documents, pypdf is frequently integrated into applications that handle user-uploaded files or process external document streams. The core issue resides in the implementation of the read_until_whitespace function located in the modules pypdf/_reader.py and pypdf/generic/_base.py. This function is responsible for parsing tokens within a PDF file, specifically looking for whitespace characters to delimit indirect-object identifiers and generation-number tokens. In versions preceding 6.18.0, the logic governing this scanning process lacks sufficient bounds checking or optimization when encountering malformed input sequences that consist of long strings without intervening whitespace.
When an attacker crafts a malicious PDF containing extended sequences of indirect-object identifiers or generation-number tokens devoid of whitespace, the parser enters a state of excessive computational consumption. Instead of efficiently skipping over such non-standard structures or failing fast with a parsing error, the library attempts to scan through the entire length of these continuous strings character by character. This behavior triggers an algorithmic complexity issue where the time required to process the input grows disproportionately relative to the size of the malicious payload. The result is a denial-of-service condition characterized by extremely long runtimes that can effectively hang or crash the hosting application, rendering it unavailable for legitimate users and consuming excessive CPU resources until system limits are reached or the process is manually terminated.
From a security classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-770, Allocation of Resources Without Limits or Throttling. The attack vector leverages the trust placed in input data by automated processing systems, exploiting the parser's inability to handle pathological inputs gracefully. In terms of adversary behavior, this technique corresponds to ATT&CK tactic T1496, Resource Hijacking, specifically under the sub-technique of CPU or memory exhaustion through resource-intensive operations. The vulnerability does not involve code execution or data exfiltration but rather focuses on disrupting service availability by forcing the application into a computationally expensive state that prevents it from performing its intended functions within acceptable timeframes.
Mitigation for this issue requires an immediate upgrade to pypdf version 6.18.0 or later, where the parsing logic has been corrected to handle such malformed inputs more efficiently and prevent excessive scanning. For organizations unable to update immediately due to dependency constraints, implementing input validation at the application boundary is recommended. This includes limiting the size of uploaded PDF files, enforcing strict schema validations on incoming document structures, and deploying web application firewalls or intrusion detection systems capable of identifying patterns indicative of this specific parsing trap. Additionally, configuring timeout mechanisms for file processing tasks can help mitigate the impact by terminating processes that exceed a predefined execution duration, thereby preserving system stability even if malicious inputs are processed before the vulnerability is patched in the underlying library.