Is CVE-2026-57204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57204 being exploited in the wild.

How severe is CVE-2026-57204?

Medium severity, with a CVSS score of 4, published 30 June 2026.

Which products and versions are affected?

pypdf (PyPI) ECOSYSTEM:introduced=0,fixed=6.13.3.

Is there a fix for CVE-2026-57204?

Yes. pypdf (PyPI): upgrade to 6.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57204 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57204?

Check whether you run pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57204: py-pdf pypdf denial of service via uncontrolled memory consumption

CVE-2026-57204 · Severity: medium · CVSS 4 · Published 2026-06-30

pypdf is a widely used Python library for reading and manipulating PDF files. A vulnerability in how the library handles certain PDF files allows an attacker to provide a specially crafted document that consumes excessive amounts of system memory. This can lead to a denial-of-service (DoS) condition, causing applications or services that process these PDFs to crash or become unresponsive.

Technologies: pypdf (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-57204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57204 being exploited in the wild.
How severe is CVE-2026-57204?: Medium severity, with a CVSS score of 4, published 30 June 2026.
Which products and versions are affected?: pypdf (PyPI) ECOSYSTEM:introduced=0,fixed=6.13.3.
Is there a fix for CVE-2026-57204?: Yes. pypdf (PyPI): upgrade to 6.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57204 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57204?: Check whether you run pypdf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pypdf (PyPI): upgrade to 6.13.3 or later
```
pip install "pypdf>=6.13.3"
```

Technical details

A vulnerability exists in pypdf due to uncontrolled resource consumption (CWE-400) when parsing PDF content streams. The library fails to enforce the 'MAX_DECLARED_STREAM_LENGTH' limit when a content stream lacks a '/Length' value. An attacker can exploit this by providing a maliciously crafted PDF that, when parsed, causes the library to allocate excessive memory. This is a remote attack vector requiring no authentication, provided the target application processes untrusted PDF files using pypdf. The issue is resolved in version 6.13.3 by ensuring the length limit is applied to all streams.

Affected products

py-pdf pypdf < 6.13.3

Identifiers

CVE-2026-57204
GHSA-jm82-fx9c-mx94

Timeline

2026-06-17: patched: Version 6.13.3 released
2026-06-17: advisory: GitHub Security Advisory GHSA-jm82-fx9c-mx94 published
2026-06-30: disclosed: CVE-2026-57204 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.