Disclosure summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0.
Source-reported weakness categories
CWE-400
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-102998
Open original source · Updated Oct 05, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| pypdf_project | pypdf | * {"versionEndExcluding":"6.19.0"} |
GitHub Reviewed Security Advisories · GHSA-php9-fj8v-98fj
Open original source · Updated Oct 01, 2026
pypdf: Possible long runtimes when generating appearance streams
Source severity: HIGH / 8.7
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | pypdf | < 6.19.0 | 6.19.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Patch, Issue Tracking
- github.com — Release Notes
- github.com — Vendor Advisory
PUBLISHED 2026-09-30T17:17:07-04:00
MODIFIED 2026-10-05T11:05:55-04:00
INGESTED 2026-10-06T11:44:59-04:00