CVE-2026-28804: pypdf: Inefficient decoding of ASCIIHexDecode streams
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter.
Patches This has been fixed in pypdf==6.7.5.
Workarounds If you cannot upgrade yet, consider applying the changes from PR #3666.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28804?
CVE-2026-28804 has a moderate severity rating due to its potential for causing long runtimes through inefficient decoding.
How do I fix CVE-2026-28804?
To fix CVE-2026-28804, update pypdf to version 6.7.5 or later.
What is the impact of CVE-2026-28804?
The impact of CVE-2026-28804 is that maliciously crafted PDF files can lead to significantly increased processing times.
Which versions of pypdf are affected by CVE-2026-28804?
CVE-2026-28804 affects versions of pypdf prior to 6.7.5.
What type of PDF streams does CVE-2026-28804 exploit?
CVE-2026-28804 exploits streams that use the /ASCIIHexDecode filter in PDF files.