pypdf EUVD-2026-90366

Exploitation requires the host application to parse an attacker-supplied PDF with pypdf before version 6.18.0; the malicious file must contain an indirect-object identifier or generation-number token that continues for a long stretch without whitespace, triggering unbounded scanning in read_until_whitespace. No authentication or user interaction is needed at the library level (PR:N/UI:N), but practical exploitation is limited to deployments that accept and automatically process untrusted PDFs (e.g., upload/ingestion services). The impact is confined to availability (worker hang / long runtime); there is no path to code execution or data disclosure.

This is a genuine but bounded risk: a CWE-400 uncontrolled-resource-consumption (algorithmic/parsing) flaw whose only impact is availability. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, score 8.7) is internally consistent with the description - no privileges, no interaction, and VA:H with VC:N/VI:N correctly captures a DoS-only outcome with no confidentiality or integrity loss. The 8.7 score is high purely because availability loss is weighted heavily under 4.0 for a trivially triggerable network-reachable condition; it does NOT indicate code execution or data exposure. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - though the fix PR/commit and GHSA advisory publicly describe the exact trigger (long unterminated indirect-object ID or generation-number tokens), lowering the barrier to weaponization. The 'network' attack vector is nominal for a library: exploitation requires the host application to feed pypdf an attacker-controlled PDF, so real risk concentrates in services that accept and parse untrusted PDF uploads. Overall this is a moderate-priority hardening fix, not an emergency - a high CVSS score driven by DoS weighting rather than by active exploitation or severe technical impact.

An attacker uploads a crafted PDF to a web service or pipeline that uses pypdf (<6.18.0) to parse or extract content. The file contains an indirect-object identifier or generation-number token that runs for a very long stretch without whitespace, causing read_until_whitespace to scan excessive input and consume CPU/time, hanging the worker and denying service. No public exploit is identified, but the GHSA advisory and fix commit publicly describe the exact trigger.