CVE-2026-102998 — pypdf: Possible long runtimes when generating appearance streams
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream ge…
Published: 2026-09-30 · CVSS: 8.7 · CVSS 4.0
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7