Executive brief
FPDI is a popular PHP library used by websites to read and manipulate PDF documents. A vulnerability allows an attacker to upload a specially crafted, small PDF file that causes the server to crash or stop responding. This can lead to a total service outage if the attack is repeated, preventing legitimate users from accessing the website or its PDF-related features.
Technical details
A denial-of-service (DoS) vulnerability exists in FPDI prior to version 2.6.7 due to uncontrolled resource consumption (CWE-400) and improper handling of recursion (CWE-770). The root cause involves faulty handling of the '/Prev' value when parsing cross-references and recursion in the page tree of a PDF document. An attacker with low privileges can upload a small, malicious PDF file that triggers an infinite loop or memory exhaustion, causing the PHP script to crash or time out. This issue has been patched in version 2.6.7 by improving the validation of cross-reference and page tree structures.
Affected products
- Setasign FPDI < 2.6.7
Timeline
- 2026-05-13: patched: Version 2.6.7 released
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-11: disclosed: CVE published to NVD