CVE-2026-45802 PUBLISHED

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

Assigner: GitHub_M
Reserved: 13.05.2026 Published: 11.06.2026 Updated: 12.06.2026

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion or a script time-out. Repeated attacks can lead to sustained service unavailability. This issue has been patched in version 2.6.7.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 6

Product Status

Vendor Setasign
Product FPDI
Versions
  • Version < 2.6.7 is affected

References

Problem Types

  • CWE-770: Allocation of Resources Without Limits or Throttling CWE
  • CWE-400: Uncontrolled Resource Consumption CWE