pypdf uncontrolled resource consumption in stream parsing

Executive brief

A vulnerability in the pypdf library, a tool used for manipulating PDF files in Python applications, can allow a specially crafted file to consume excessive system memory. This could lead to a denial-of-service condition where the application or server processing the PDF becomes unresponsive or crashes. Organizations using this library to process user-uploaded PDF documents are most at risk.

Technical details

The pypdf library fails to properly enforce the 'MAX_DECLARED_STREAM_LENGTH' limit when parsing PDF content streams that lack a defined '/Length' value. This falls under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). An attacker can exploit this by providing a malicious PDF file that, when parsed, causes the application to allocate excessive amounts of memory. The vulnerability is triggered during the parsing of content streams, and a fix is available in version 6.13.3.

Affected products

• py-pdf pypdf < 6.13.3

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory
• 2026-06-13: patched: Version 6.13.3 released

References

• https://api.github.com/users/sondt99
• https://github.com/sondt99
• https://api.github.com/users/sondt99/gists%7B/gist_id%7D
• https://api.github.com/users/sondt99/repos
• https://avatars.githubusercontent.com/u/87920408?v=4
• https://api.github.com/users/sondt99/events%7B/privacy%7D