Patch AnalysisSep 30, 202611 min read
CVE-2026-102994: Unbounded Token Scanning and CPU Exhaustion in pypdf
Root-cause analysis of CVE-2026-102994: before pypdf 6.18.0, a PDF with a very long object number and no whitespace made the parser read the token to its end with no limit, which can tie up a worker for a long time.
