CVE-2026-102995: pypdf Large Memory Consumption Vulnerability
Summary
CVE-2026-102995: pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2). Affects pypdf versions < 6.18.1. Fixed in 6.18.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library designed for PDF manipulation, including reading, writing, and modifying PDF files. It provides functionalities such as text extraction, merging, and splitting PDFs. However, it is susceptible to vulnerabilities that can lead to excessive memory usage, particularly when handling specific PDF structures.
Vulnerability Detail
The vulnerability arises from the handling of the '/ToUnicode' entry in PDF fonts, which can be exploited by an attacker to create a PDF file that consumes an excessive amount of memory during parsing. This can lead to denial of service conditions, where legitimate users may experience degraded performance or complete application failure. The issue is particularly critical when extracting text from PDFs with unusually large '/ToUnicode' streams.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.18.1
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.18.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade immediately, you can apply the changes from pull request #4071 on GitHub. This involves modifying the handling of the '/ToUnicode' entry to mitigate memory consumption issues. For detailed instructions, refer to the PR documentation on GitHub.
Conclusion
In summary, the CVE-2026-102995 vulnerability in the pypdf library can lead to significant memory consumption when processing certain PDF files. It is crucial to update to the patched version 6.18.1 or apply the recommended workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for pypdf →
FAQ
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is excessive memory consumption, which can lead to application crashes or denial of service for users trying to access affected PDF files.
Yes, you should upgrade to pypdf version 6.18.1 or later to ensure that the vulnerability is patched.
If an immediate upgrade is not possible, consider applying the changes from pull request #4071 as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
