GHSA-763m-79hh-57f2: Pip/pypdf vulnerability
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.16.1 - Upgrade
Upgrade
py-pdf/pypdfto a version that resolves this vulnerability.Fixed in 6.16.1 - Compensating control
If you cannot upgrade yet, apply the changes from PR [#3966] referenced in the material.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that use pypdf to extract text from PDF pages are exposed when processing PDFs containing many XForm objects, particularly where XForm objects are reused.
What must an attacker do to trigger the issue?
An attacker must provide a crafted PDF and cause the application to extract text from an affected page. Successful exploitation results in long runtimes and high memory consumption.
What should I do if I cannot upgrade immediately?
Apply the changes from PR #3966 as a workaround. The issue is fixed in pypdf 6.16.1.