pypdf CVE-2026-102998

Requires the consuming application to process an attacker-supplied PDF through pypdf's form-field update path with flattening enabled (update_page_form_field_values with flatten=True), and the malicious PDF must contain a choice/form field with a large number of options and selected values so the invariant selection-glyph computation repeats per line. Limiting factors: the vulnerable code path is not reached by merely opening or reading a PDF - the application must explicitly perform field updates with flattening; impact is availability only (no data exposure or code execution); pypdf < 6.19.0 must be in use.

Signals are consistent in pointing to a moderate, availability-only risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, base 8.7 'High') describes an unauthenticated, network-reachable algorithmic-complexity DoS with no confidentiality or integrity impact (VC:N/VI:N). No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is 'no public exploit identified at time of analysis' - although the fixing PR (#4087) ships a reproducer test (test_generate_appearance_stream_data__selection__speed with a 10s timeout), so a working trigger is effectively public in the test suite even if not packaged as a standalone exploit. The vendor 8.7 is aggressive for a pure availability bug: the PR:N/UI:N metrics understate a real precondition - the flaw only fires when the CONSUMING application invokes pypdf's form-field update path with flattening enabled on the attacker's PDF, which is application/config-dependent rather than a default-exposed network service. This is best treated as a library-hardening/DoS priority (patch during normal cycles) rather than an emergency: real exploitation requires a document-processing pipeline that both accepts untrusted PDFs and flattens their form fields. No signals conflict beyond the vendor severity being on the high side for a VA-only issue.

An attacker submits a crafted PDF containing a choice form field with a very large number of options and selected values (the reproducer uses ~1000 each) to a service that uses pypdf to fill and flatten form fields. When the application calls update_page_form_field_values(..., flatten=True), pypdf's appearance-stream generator recomputes the invariant selection-to-glyph mapping on every line of the loop, causing near-quadratic runtime that hangs the worker and denies service. No standalone public exploit is published, but the fixing PR includes a timing reproducer that demonstrates the trigger.