CVE-2026-45802 FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
An attacker can cause server crashes and service unavailability by uploading a malicious PDF file to applications using the FPDI library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45802?
CVE-2026-45802 is a medium-severity denial of service vulnerability in Setasign FPDI, published on 11 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion or a script time-out. Repeated attacks can lead to sustained service unavailability. This issue has been patched in version 2.6.7.
Which versions are affected by CVE-2026-45802?
2 open source packages ship an affected version, including setasign/fpdi.
| Package | Affected | Fixed in |
|---|---|---|
setasign/fpdi Packagist | All versions | 2.6.7 |
setasign/fpdi Packagist | All versions | 2.6.7 |
How do I fix CVE-2026-45802?
Upgrade setasign/fpdi to 2.6.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45802 being exploited?
There is no known exploitation of CVE-2026-45802 in the wild and no public exploit code.
Sources
Also known as GHSA-2mgw-7q6p-8grg.