GHSA-php9-fj8v-98fj: Pip/pypdf vulnerability

Q: What application behavior must be present for this issue to be triggered?

The affected application must update PDF form field values with flattening enabled. That operation triggers appearance stream generation, which a crafted PDF can cause to run for a long time.

Q: What should teams do if they cannot upgrade immediately?

Apply the changes from PR #4087 as a workaround until an upgrade is possible.

Q: Which release contains the fix?

The issue is fixed in pypdf 6.19.0.

Published Oct 1, 2026

Updated

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation.

Patches

This has been fixed in pypdf==6.19.0.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #4087.

Affected Software

1 affected componentFixes available

pip/pypdf<6.19.0

6.19.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pypdf to a version that resolves this vulnerability.
Fixed in 6.19.0
Upgrade
Upgrade pypdf to a version that resolves this vulnerability.
Fixed in 6.19.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch #4087

Event History

Oct 1, 2026

Advisory Published

via GitHub·03:07 PM

Data Sourced

via GitHub·03:07 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What application behavior must be present for this issue to be triggered?

The affected application must update PDF form field values with flattening enabled. That operation triggers appearance stream generation, which a crafted PDF can cause to run for a long time.

What should teams do if they cannot upgrade immediately?