GHSA-7mh2-4gg2-979f: Pip/pypdf vulnerability

Q: Who is exposed to this issue?

Applications using pypdf are exposed when they process PDFs containing a stream with many filters or multiple filters that pass large amounts of data.

Q: What does an attacker need to do to trigger the problem?

An attacker needs to craft a PDF whose stream uses a large number of filters or filters that repeatedly handle large amounts of data, then cause the application to process that PDF.

Q: Which version contains the fix?

The issue is fixed in pypdf 6.20.0.

Q: What can be done if an immediate upgrade is not possible?

Consider applying the changes from PR #4173 as a workaround.

Published Oct 21, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.

Patches

This has been fixed in pypdf==6.20.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4173.

Affected Software

1 affected componentFixes available

pip/pypdf<6.20.0

6.20.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.20.0
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.20.0
Compensating control
If unable to upgrade, apply the changes from PR #4173 as a workaround.

Event History

Oct 21, 2026

Advisory Published

via GitHub·04:48 PM

Data Sourced

via GitHub·04:48 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using pypdf are exposed when they process PDFs containing a stream with many filters or multiple filters that pass large amounts of data.

What does an attacker need to do to trigger the problem?

An attacker needs to craft a PDF whose stream uses a large number of filters or filters that repeatedly handle large amounts of data, then cause the application to process that PDF.

Which version contains the fix?

The issue is fixed in pypdf 6.20.0.

What can be done if an immediate upgrade is not possible?

Consider applying the changes from PR #4173 as a workaround.

GHSA-7mh2-4gg2-979f: Pip/pypdf vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the problem?

Which version contains the fix?

What can be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the problem?

Which version contains the fix?

What can be done if an immediate upgrade is not possible?