GHSA-jxhh-4648-vpp3Medium

FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

Published
August 5, 2025
Last Modified
August 6, 2025

🔗 CVE IDs covered (1)

CVE-2025-54869 →

📋 Description

Impact

This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process user-supplied PDF files is at risk. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability.

Patches

Fixed as of version 2.6.4

Workarounds

No.

🎯 Affected products1

  • composer/setasign/fpdi:< 2.6.4

🔗 References (4)