GHSA-6vvc-x485-93v7: Pip/pypdf vulnerability
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.
Patches
This has been fixed in pypdf==6.21.0.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #4219.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.21.0 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.21.0
Event History
Frequently Asked Questions
What application behavior is required for exploitation?
The application must retrieve form fields from an attacker-crafted PDF. Processing PDFs without retrieving their form fields is not described as affected.
What is the impact of a successful attack?
A crafted PDF can cause large memory consumption and/or long runtimes, creating a denial-of-service risk for the process handling the document.
What should teams do if they cannot upgrade immediately?
Consider applying the changes from PR #4219 as a workaround until an upgrade is possible.