{"id":"CVE-2026-102999","published":"2026-09-30T21:17:07.343","lastModified":"2026-10-05T15:04:55.217","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400","CWE-407"],"vendors":["pypdf project"],"products":["pypdf"],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/6b10556d13609a68f9ed18bb29fdd8bba88eb2c3","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4081","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.19.0","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-v247-6f48-mgcj","tags":["Vendor Advisory"]}],"exploitRefs":[{"url":"https://github.com/py-pdf/pypdf/commit/6b10556d13609a68f9ed18bb29fdd8bba88eb2c3","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4081","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.19.0","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-v247-6f48-mgcj","tags":["Vendor Advisory"]}],"hasPoc":true,"ai":{"summary":"The pypdf library suffers from a denial-of-service vulnerability where crafted PDF files with many embedded files can cause excessive CPU usage and slow processing times due to repeated reparsing of attachment lists. This affects applications that access embedded file mappings in PDFs.","exploitability":"Exploitation is moderately difficult as it requires crafting a specific PDF with many embedded files and having an application process it, but the attack can be automated through PDF generation tools.","blast_radius":"The impact could affect any application using pypdf to process PDFs with embedded files, potentially causing service unavailability or performance degradation across multiple systems.","remediation":"Upgrade to pypdf version 6.19.0 or later to fix the issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","pdf","python","library"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:07:11.648Z"}}