A high-severity resource consumption vulnerability in pypdf enables unauthenticated attackers to trigger a denial-of-service state.

This issue (CWE-400) occurs due to insufficient validation of input, allowing unauthenticated attackers to trigger excessive resource consumption during PDF parsing. This leads to system instability or service unavailability.

Exploitation of this vulnerability poses a significant threat to service availability. With a CVSS score of 8.7, the impact is severe; an attacker can effectively disable PDF-reliant business workflows, leading to operational downtime and potential data processing bottlenecks.

Immediate Action: Update the pypdf library to version 6.14.1 or later to implement proper resource management and input validation.

Proactive Monitoring: Implement monitoring for memory and CPU spikes during document ingestion and review system logs for patterns of repeated or failed parsing attempts.

Compensating Controls: Employ a Web Application Firewall (WAF) or an input validation layer to sanitize or limit the size/complexity of incoming PDF files before they reach the processing engine.

Public Exploit Available: false

Given the high CVSS score and the potential for service disruption, administrators must patch pypdf to version 6.14.1 immediately. Failure to update leaves the application vulnerable to remote denial-of-service attacks.