Resource exhaustion in Setasign Fpdi
CVE-2026-45802
FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload a small, malicious PDF file that will cause the server-side s…
Vulnerability class: DoS (Denial of Service)
EPSS: 0.003 (17.6th percentile) — read the EPSS interpretation.
Affected products
- Setasign Fpdi — versions < 2.6.7
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)