Skip to content

Possible long runtimes for malformed FlateDecode streams

Moderate
stefan6419846 published GHSA-9mvc-8737-8j8h Feb 17, 2026

Package

pip pypdf (pip)

Affected versions

< 6.7.1

Patched versions

>= 6.7.1

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3644.

Severity

Moderate

CVE ID

CVE-2026-27026

Weaknesses

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource. Learn more on MITRE.

Credits