CVE-2026-28351

Description

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.

PUBLISHED Reserved 2026-02-26 | Published 2026-02-27 | Updated 2026-03-03 | Assigner GitHub_M

Problem types

CWE-400: Uncontrolled Resource Consumption

Product status

References

github.com/.../pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg

github.com/py-pdf/pypdf/pull/3664

github.com/...ommit/f309c6003746414dc7b5048c19e6d879ff2dc858

github.com/py-pdf/pypdf/releases/tag/6.7.4

cve.org (CVE-2026-28351)

nvd.nist.gov (CVE-2026-28351)

Download JSON