UNKNOWN PyPI
pypdf: Manipulated RunLengthDecode streams can exhaust RAM
GHSA-f2v5-7jq9-h8cg · CVE-2026-28351
Published · Modified
Description
Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter.
Patches
This has been fixed in pypdf==6.7.4.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3664.
References
- WEB https://github.com/py-pdf/pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28351
- WEB https://github.com/py-pdf/pypdf/pull/3664
- WEB https://github.com/py-pdf/pypdf/commit/f309c6003746414dc7b5048c19e6d879ff2dc858
- PACKAGE https://github.com/py-pdf/pypdf
- WEB https://github.com/py-pdf/pypdf/releases/tag/6.7.4
Ready to move
Start Securing
Free, no credit card | First findings in minutes