CVE-2026-57204: pypdf: Missing stream length values ignore defined limits
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAXDECLAREDSTREAMLENGTH is sometimes ignored. This requires parsing a content stream without a /Length value. This issue has been fixed in version 6.13.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.13.3 - Compensating control
If you parse PDFs with content streams that do not include a /Length value, apply a compensating control to limit resource usage (e.g., restrict/limit PDF parsing workload or isolate the parsing process) until all instances are upgraded to pypdf 6.13.3.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57204?
CVE-2026-57204 has a medium severity rating of 6.9 according to the CVSS v3.0.
How do I fix CVE-2026-57204?
To mitigate CVE-2026-57204, update the pypdf library to version 6.13.3 or later.
What type of vulnerability is CVE-2026-57204?
CVE-2026-57204 is a Denial of Service (DoS) vulnerability in the pypdf library.
What impact does CVE-2026-57204 have?
CVE-2026-57204 can lead to excessive memory usage when processing a maliciously crafted PDF.
Who is affected by CVE-2026-57204?
Users of the pypdf library prior to version 6.13.3 are affected by CVE-2026-57204.