PyPI/pypdf CVE-2026-102994: high 7.5, EPSS 0.34%

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Action: Upgrade pypdf to 6.18.0 or later.

pip install pypdf==6.18.0

Affected

Fixed versions

Sources

• osv: GHSA-5jq2-8x83-x246
• nvd: CVE-2026-102994
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-5jq2-8x83-x246
• https://github.com/py-pdf/pypdf/pull/4055
• https://github.com/py-pdf/pypdf/commit/82501d2993c6387833c4949d205caeb188f8bb9e
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.18.0

CVE-2026-102994 · published 2026-10-01T15:05:53Z · modified 2026-10-01T17:55:50.646603075Z · JSON