CVE-2025-54869: FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

August 5, 2025 (updated August 6, 2025)

This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process user-supplied PDF files is at risk. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability.

References

github.com/Setasign/FPDI
github.com/Setasign/FPDI/commit/ba671ba9221cffd32c2dda87316c19f522a1c5f0
github.com/Setasign/FPDI/security/advisories/GHSA-jxhh-4648-vpp3
github.com/advisories/GHSA-jxhh-4648-vpp3
nvd.nist.gov/vuln/detail/CVE-2025-54869

Code Behaviors & Features

Detect and mitigate CVE-2025-54869 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →