Skip to content

Manipulated XMP metadata entity declarations can exhaust RAM

Moderate
stefan6419846 published GHSA-3crg-w4f6-42mx Apr 10, 2026

Package

pip pypdf (pip)

Affected versions

< 6.10.0

Patched versions

>= 6.10.0

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata.

Patches

This has been fixed in pypdf==6.10.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3724.

Severity

Moderate

CVE ID

CVE-2026-40260

Weaknesses

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. Learn more on MITRE.

Credits