Executive brief
pypdf is a widely used Python library for reading and manipulating PDF files. A vulnerability in how the library handles certain PDF files allows an attacker to provide a specially crafted document that consumes excessive amounts of system memory. This can lead to a denial-of-service (DoS) condition, causing applications or services that process these PDFs to crash or become unresponsive.
Technical details
A vulnerability exists in pypdf due to uncontrolled resource consumption (CWE-400) when parsing PDF content streams. The library fails to enforce the 'MAX_DECLARED_STREAM_LENGTH' limit when a content stream lacks a '/Length' value. An attacker can exploit this by providing a maliciously crafted PDF that, when parsed, causes the library to allocate excessive memory. This is a remote attack vector requiring no authentication, provided the target application processes untrusted PDF files using pypdf. The issue is resolved in version 6.13.3 by ensuring the length limit is applied to all streams.
Affected products
- py-pdf pypdf < 6.13.3
Timeline
- 2026-06-17: patched: Version 6.13.3 released
- 2026-06-17: advisory: GitHub Security Advisory GHSA-jm82-fx9c-mx94 published
- 2026-06-30: disclosed: CVE-2026-57204 published to NVD