CVE-2026-102994: pypdf: Possible long runtimes/large memory usage when parsing indirect objects

October 1, 2026

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace.

References

github.com/advisories/GHSA-5jq2-8x83-x246
github.com/py-pdf/pypdf/commit/82501d2993c6387833c4949d205caeb188f8bb9e
github.com/py-pdf/pypdf/pull/4055
github.com/py-pdf/pypdf/releases/tag/6.18.0
github.com/py-pdf/pypdf/security/advisories/GHSA-5jq2-8x83-x246
nvd.nist.gov/vuln/detail/CVE-2026-102994

Code Behaviors & Features

Detect and mitigate CVE-2026-102994 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →