CVE-2026-27025: pypdf Long Runtime and Memory Consumption Vulnerability
Summary
CVE-2026-27025: pypdf has possible long runtimes/large memory usage for large /ToUnicode streams. Affects pypdf versions < 6.7.1. Fixed in 6.7.1. How to fix ↓
Also tracked for
The same CVE-2026-27025 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pypdf is a popular Python library used for manipulating PDF files. It allows users to extract text, merge documents, and perform various operations on PDF files. The library is widely utilized in applications that require PDF processing due to its ease of use and robust functionality. However, it is susceptible to a vulnerability that can lead to excessive runtime and memory usage when handling specific PDF structures.
Vulnerability Detail
The vulnerability arises from the way pypdf parses the '/ToUnicode' entry of fonts in PDF files. An attacker can craft a malicious PDF containing unusually large values in this entry, which can cause the library to enter a state of prolonged execution and consume significant memory resources. This can lead to denial of service conditions, affecting the performance and stability of applications that rely on pypdf for PDF processing.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.7.1
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade to the patched version immediately, you can apply the changes from pull request #3646 on GitHub. This involves modifying the code to handle large '/ToUnicode' entries more efficiently, thus mitigating the impact of the vulnerability.
Conclusion
In summary, the pypdf library has a vulnerability (CVE-2026-27025) that can lead to long runtimes and large memory usage due to the parsing of large '/ToUnicode' entries in PDF files. It is crucial to update to version 6.7.1 or later to mitigate this risk. If immediate upgrading is not possible, applying the changes from the relevant pull request can serve as a temporary workaround.
See every vulnerability recorded for pypdf →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate level of risk.
If left unaddressed, this vulnerability can lead to long runtimes and high memory consumption, potentially causing denial of service in applications using pypdf.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, you should upgrade to pypdf version 6.7.1 or later to ensure that the vulnerability is patched.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. It helps you stay informed about potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
