Disclosure summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.
Source-reported weakness categories
CWE-400, CWE-407
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-102994
Open original source · Updated Oct 05, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| pypdf_project | pypdf | * {"versionEndExcluding":"6.18.0"} |
GitHub Reviewed Security Advisories · GHSA-5jq2-8x83-x246
Open original source · Updated Oct 01, 2026
pypdf: Possible long runtimes/large memory usage when parsing indirect objects
Source severity: HIGH / 8.7
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | pypdf | < 6.18.0 | 6.18.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Patch, Issue Tracking
- github.com — Release Notes
- github.com — Vendor Advisory
PUBLISHED 2026-09-30T16:17:28-04:00
MODIFIED 2026-10-05T11:24:04-04:00
INGESTED 2026-10-06T11:44:59-04:00