GHSA-cgf9-327m-v77c: Pip/pypdf vulnerability

Q: Who is exposed to this issue?

Applications that parse attacker-controlled or otherwise untrusted PDF files with pypdf are exposed, particularly when they process PDF content streams.

Q: What must an attacker provide to trigger the problem?

The attacker must supply a crafted PDF containing content streams with many small operations. Parsing that PDF can cause large memory usage.

Q: Which version contains the fix?

The issue is fixed in pypdf 6.21.0.

Q: What can be done if upgrading is not immediately possible?

Consider applying the changes from PR #4218 as a workaround.

Published Oct 22, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.

Patches

This has been fixed in pypdf==6.21.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4218.

Affected Software

1 affected componentFixes available

pip/pypdf<6.21.0

6.21.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.21.0
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.21.0

Event History

Oct 22, 2026

Advisory Published

via GitHub·04:49 PM

Data Sourced

via GitHub·04:49 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications that parse attacker-controlled or otherwise untrusted PDF files with pypdf are exposed, particularly when they process PDF content streams.

What must an attacker provide to trigger the problem?