CVE-2026-102994

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.

• CWE-400
• CWE-407

• https://github.com/py-pdf/pypdf/commit/82501d2993c6387833c4949d205caeb188f8bb9e
• https://github.com/py-pdf/pypdf/pull/4055
• https://github.com/py-pdf/pypdf/releases/tag/6.18.0
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-5jq2-8x83-x246

Published

Sep 30, 2026

Last Modified

Oct 1, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102984Astro is a web framework for content-driven websites. Prior …8.2
• CVE-2026-10299A weakness has been identified in code-projects Online Hospi…3.8
• CVE-2026-102990basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Clie…8.2
• CVE-2026-102991Mako is a template library written in Python. Prior to 1.4.2…6.5
• CVE-2026-102992piscina is a node.js worker pool implementation. Prior to 4.…9.2
• CVE-2026-102993pypdf is a free and open-source pure-python PDF library. Pri…8.7
• CVE-2026-102995pypdf is a free and open-source pure-python PDF library. Pri…8.7
• CVE-2026-102996pypdf is a free and open-source pure-python PDF library. Pri…8.7
• CVE-2026-102997pypdf is a free and open-source pure-python PDF library. Pri…8.7
• CVE-2026-102998pypdf is a free and open-source pure-python PDF library. Pri…8.7
• CVE-2026-102999pypdf is a free and open-source pure-python PDF library. Pri…8.7
• CVE-2026-1030IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2…4.3