CVE-2025-55197: PyPDF's FlateDecode Stream Vulnerability Leading to RAM Exhaustion
Summary
CVE-2025-55197: PyPDF's Manipulated FlateDecode streams can exhaust RAM. Affects pypdf versions < 6.0.0. Fixed in 6.0.0. How to fix ↓
Also tracked for
- pypdf · Debian:12
The same CVE-2025-55197 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyPDF is a Python library that allows users to manipulate PDF files. It provides functionalities such as merging, splitting, and modifying PDF documents. The library is widely used for its ease of use and flexibility in handling PDF content. However, it is susceptible to a vulnerability that can be exploited through crafted PDF files, specifically involving FlateDecode streams.
Vulnerability Detail
The vulnerability arises from the way PyPDF handles FlateDecode filters in PDF files. An attacker can create a malicious PDF that, when processed, leads to excessive RAM consumption. This occurs when a series of FlateDecode filters are applied to a cross-reference stream, causing the application to exhaust available memory. The impact is significant as it can lead to application crashes or denial of service, especially in environments where memory resources are limited.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0.0
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround can be implemented by modifying the decompress function in the filters module. The relevant code can be found here: https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143. Users are encouraged to review and adapt this code to mitigate the vulnerability until an upgrade is feasible.
Conclusion
CVE-2025-55197 is a moderate severity vulnerability in the PyPDF library that can lead to RAM exhaustion through crafted PDF files. Users are advised to upgrade to version 6.0.0 to mitigate this risk or implement the suggested workaround until an upgrade is possible.
See every vulnerability recorded for pypdf →
FAQ
CVE-2025-55197 is a vulnerability in the PyPDF library that allows attackers to craft PDF files that can exhaust system RAM, leading to potential application crashes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring installation.
If upgrading is not an option, consider implementing the provided workaround to mitigate the risk until you can update.
FlateDecode filters are used in PDF files to compress data. They can be exploited if not handled properly, leading to vulnerabilities like CVE-2025-55197.
While the primary risk is RAM exhaustion and potential application crashes, there is no direct indication of data loss associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
