Executive brief
pypdf is a widely used Python library for manipulating PDF files. A vulnerability has been identified where a specially crafted PDF file can cause the library to enter a state of extremely long processing times. This could allow an attacker to cause a denial-of-service (DoS) condition, potentially crashing or slowing down applications that automatically process uploaded PDF documents.
Technical details
The vulnerability is classified as Uncontrolled Resource Consumption (CWE-400) within the pypdf library. It is triggered by PDF files containing repeated malformed cross-reference (XRef) streams. When pypdf attempts to parse these specific malformed entries, it results in excessive CPU usage and long runtimes. An attacker can exploit this by providing a crafted PDF to any application using a vulnerable version of the library. The issue is fixed in version 6.14.0 by improving the handling of malformed cross-reference entries.
Affected products
- py-pdf pypdf < 6.14.0
Timeline
- 2026-06-22: disclosed: Initial report and internal tracking
- 2026-07-08: advisory: NVD publication date
- 2026-07-23: advisory: GitHub Advisory published