CVE-2026-102999: pypdf Long Runtime Vulnerability Due to Embedded Files
Summary
CVE-2026-102999: pypdf: Possible long runtimes with large amount of embedded files. Affects pypdf versions < 6.19.0. Fixed in 6.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library that allows for the manipulation and creation of PDF files. It provides a range of functionalities, including merging, splitting, and modifying PDF documents. The library is widely used in applications that require PDF processing. However, it has a vulnerability that can lead to excessive runtimes when handling PDFs with a large number of embedded files, particularly when accessed through the dictionary-based API.
Vulnerability Detail
The vulnerability arises from the way pypdf processes embedded files within PDF documents. An attacker can craft a malicious PDF that, when accessed, causes the application to experience long runtimes. This can lead to denial of service as the application becomes unresponsive while processing the PDF. The issue is particularly concerning for applications that rely on pypdf for PDF manipulation, as it can be exploited to disrupt service and degrade performance.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.19.0
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.19.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade to the latest version immediately, you can apply the changes from pull request #4081. This involves modifying the code to handle embedded files more efficiently, reducing the risk of long runtimes. Review the changes in the pull request for specific implementation details.
Conclusion
The pypdf library has a vulnerability (CVE-2026-102999) that can lead to long runtimes when processing PDFs with many embedded files. It is crucial to update to version 6.19.0 or later to mitigate this risk. If an immediate upgrade is not possible, applying the changes from the relevant pull request can serve as a temporary solution.
See every vulnerability recorded for pypdf →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include denial of service due to long runtimes when processing malicious PDFs, which can disrupt application performance.
Yes, you should upgrade to pypdf version 6.19.0 or later to mitigate this vulnerability.
If you cannot upgrade immediately, consider applying the changes from pull request #4081 as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
