6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45802

CVE-2026-45802: FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion or a script time-out. Repeated attacks can lead to sustained service unavailability. This issue has been patched in version 2.6.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45802

CVE-2026-45802:

6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
setasign/fpdi	composer	< 2.6.7	2.6.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows for a Denial of Service through memory exhaustion or an endless loop when processing a malicious PDF file. The root cause is the lack of protection against cyclical object references within the PDF structure. The analysis of the commits patching this vulnerability (from version 2.6.6 to 2.6.7) reveals two primary vulnerable functions:

setasign\Fpdi\PdfParser\CrossReference\CrossReference::__construct: This function is responsible for parsing the cross-reference table of a PDF. The vulnerability existed because the code did not check for circular dependencies in the /Prev chain of the cross-reference table. An attacker could craft a PDF where this chain creates an infinite loop, causing the constructor to continuously try to parse the same data, leading to resource exhaustion. The patch adds a tracking mechanism for visited table offsets to detect and prevent such loops.
setasign\Fpdi\PdfReader\Page::getAttribute: This function retrieves attributes for a PDF page, including those inherited from parent pages. The vulnerability was in the logic that traverses the page tree upwards via the /Parent reference. A malicious PDF could define a page hierarchy with a circular reference (e.g., a child page listing an ancestor as its parent). When getAttribute would try to resolve an inherited attribute, it would enter an infinite loop traversing this circular page tree. The patch resolves this by introducing recursion detection during the object resolution process.

Both functions are core to the PDF parsing process in FPDI and would be present in a runtime profile when a malicious file triggers the vulnerability.

Vulnerable functions

setasign\Fpdi\PdfParser\CrossReference\CrossReference::__construct

src/PdfParser/CrossReference/CrossReference.php

The constructor for the CrossReference class was vulnerable to an infinite loop. If a PDF file's cross-reference section contained a circular reference via the '/Prev' key, the `while` loop that processes the cross-reference stream would never terminate, leading to resource exhaustion. The patch introduces a check to track visited offsets and throws an exception if a cycle is detected.

setasign\Fpdi\PdfReader\Page::getAttribute

src/PdfReader/Page.php

The `getAttribute` method was vulnerable to an infinite loop caused by recursion in the page tree structure of a PDF. If a page's '/Parent' attribute pointed to an ancestor, creating a circular reference, the `while` loop that traverses up the page tree to find inherited attributes would never terminate. The patch mitigates this by passing an `$ensuredObjectList` to the `PdfType::resolve` method to detect and prevent such recursion.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.