Executive brief
pypdf is a popular open-source Python library used for reading, splitting, and merging PDF files. A vulnerability in the library allows a specially crafted PDF file to consume excessive amounts of system memory when its text is being extracted. This could lead to a denial-of-service condition, causing applications using the library to crash or become unresponsive.
Technical details
A vulnerability classified as CWE-400 (Uncontrolled Resource Consumption) exists in pypdf prior to version 6.12.2. The issue is rooted in the text extraction logic, specifically when handling form XObjects that contain self-references. An attacker can exploit this by providing a malicious PDF that triggers an infinite loop or deep recursion during text extraction, leading to high memory consumption and a potential crash. The vulnerability is triggered when a developer calls text extraction methods on a page containing these malicious objects. The fix, introduced in version 6.12.2, improves loop control and resource management during the extraction process.
Affected products
- py-pdf pypdf < 6.12.2
Timeline
- 2026-05-26: patched: Fixed in version 6.12.2
- 2026-05-26: advisory: GitHub Security Advisory GHSA-j543-4vmf-qm7v published
- 2026-06-22: disclosed: NVD publication date