CVE-2026-102998 is a High severity denial of service in pypdf. Before version 6.19.0, a crafted PDF with certain form field values can make appearance stream generation repeat work inside a loop when an application updates fields with flattening on. Upgrade to 6.19.0 or later.
What's affected
- Package: pypdf (pip).
- Affected: all versions before 6.19.0, per the project advisory.
- Fixed: 6.19.0, released 16 September 2026 according to the release page.
- Trigger: updating form field values with flattening enabled, which triggers appearance stream generation.
The record gives a CVSS score of 7.5 and a severity of High. The project's own GitHub advisory labels this issue Moderate. Both are shown here. Treat the score as a prioritisation input and judge the real impact by whether untrusted PDFs reach your parser.
How to check if you're exposed
pypdf is a Python package, so start with the version installed in each environment that handles PDFs.
pip show pypdf
pip freeze | grep -i pypdf
grep -ri "pypdf" requirements*.txt pyproject.toml poetry.lock uv.lock Pipfile.lock 2>/dev/null
Check every place a PDF is parsed: web upload handlers, background workers, document pipelines and notebooks. Containers matter too, because an old image can pin an old pypdf long after the source repository moved on. Also look at transitive installs. Another library may pull pypdf in without listing it in your own requirements file.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
For this CVE, search your code for form filling calls that pass the flatten option. Services that only read PDFs, or that fill forms without flattening, are outside the trigger the advisory describes.
What to do now
- Upgrade pypdf to 6.19.0 or later in every environment that parses PDFs. Version 6.19.0 or later covers every pypdf advisory in this series of posts.
- Run your PDF test suite after the upgrade. Fill and flatten a few representative forms and compare the output to what you had before.
- Rebuild container images and redeploy so old layers do not keep the vulnerable package.
- Put limits around PDF handling in the meantime: file size caps, a time limit per job, and a memory limit on the worker, so one bad file cannot take the service down.
- Re-scan your lockfiles after the change to confirm no second copy of pypdf remains.
Why it matters
This is CWE-400 through repeated work. The release notes say the fix moves a static value out of the loop body for appearance stream data. In plain terms, the code recomputed the same selection data for every iteration, so cost grew quickly with the number of entries.
The condition is narrow: it needs form updating with flattening. That makes it a good candidate for reachability analysis. If no code in your application calls that path, the CVE is present in your dependency tree but unlikely to be reachable, and you can schedule the upgrade with the rest of your normal maintenance.
If you do run a form filling service that accepts input PDFs from outside, treat it as more urgent. The record does not list this CVE as exploited in the wild.
Quick check
Does reading a PDF trigger this?
The advisory says the trigger is updating form field values with flattening enabled. Plain reading is not described as a trigger.
What is the fix?
6.19.0 moves invariant work out of the loop that builds appearance stream data, per the release notes.
Sources
Last reviewed: 18 October 2026.
