CVE-2026-102999
published 2026-09-30CVE-2026-102999: pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.34%
26.8th percentile
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform | automation-orchestrator-backend-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| py-pdf | pypdf | < 6.19.0 | 6.19.0 |
| pypdf_project | pypdf | < 6.19.0 | 6.19.0 |
| pypdf_project | pypdf | >= 0 < 6.19.0 | 6.19.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-ogx-core-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pypdf: Possible long runtimes with large amount of embedded files
ghsa·2026-10-01
CVE-2026-102999 [HIGH] CWE-400 pypdf: Possible long runtimes with large amount of embedded files
pypdf: Possible long runtimes with large amount of embedded files
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API.
### Patches
This has been fixed in [pypdf==6.19.0](https://github.com/py-pdf/pypdf/releases/tag/6.19.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4081](https://github.com/py-pdf/pypdf/pull/4081).
VulDB
py-pdf pypdf up to 6.18.x Dictionary-Based Attachments API pypdf/_doc_common.py resource consumption
vuldb·2026-09-30·CVSS 8.7
CVE-2026-102999 [HIGH] py-pdf pypdf up to 6.18.x Dictionary-Based Attachments API pypdf/_doc_common.py resource consumption
A vulnerability described as problematic has been identified in py-pdf pypdf up to 6.18.x. The impacted element is an unknown function of the file pypdf/_doc_common.py of the component Dictionary-Based Attachments API. The manipulation results in resource consumption.
This vulnerability is reported as CVE-2026-102999. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
Red Hat
pypdf: pypdf: Denial of Service via crafted PDF with numerous embedded files
vendor_redhat·2026-09-30·CVSS 8.7
CVE-2026-102999 [HIGH] CWE-606 pypdf: pypdf: Denial of Service via crafted PDF with numerous embedded files
pypdf: pypdf: Denial of Service via crafted PDF with numerous embedded files
A flaw was found in pypdf. An attacker can cause a Denial of Service (DoS) by supplying a specially crafted PDF document containing a large number of embedded files. When an application accesses the attachment mapping, the library repeatedly reparses the entire attachment list for each lookup. This repetitive processing consumes excessive computational resources, leading to severe performance degradation and unresponsiveness.
Package: ansible-automation-platform/automation-orchestrator-backend-rhel9 (Ansible Automation Orchestrator 2026) - Affected
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Affected
Package: ligh
No detection rules found.
No public exploits indexed.
2026-09-30
Published