CVE-2026-27026: pypdf Long Runtime Vulnerability in Malformed FlateDecode Streams
Summary
CVE-2026-27026: pypdf possibly has long runtimes for malformed FlateDecode streams. Affects pypdf versions < 6.7.1. Fixed in 6.7.1. How to fix ↓
Also tracked for
The same CVE-2026-27026 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library designed for manipulating PDF files. It allows users to create, modify, and extract information from PDFs. The library is widely used due to its ease of use and comprehensive functionality. However, it is susceptible to a vulnerability that can lead to prolonged processing times when handling malformed FlateDecode streams, which could be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the way pypdf processes FlateDecode streams. An attacker can craft a malicious PDF file containing a malformed FlateDecode stream, which causes the library to enter a state of excessive runtime during byte-by-byte decompression. This can lead to denial of service as the application may hang or become unresponsive while processing the crafted PDF. The vulnerability is classified under CWE-770, which pertains to insufficiently bounded resource consumption.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.7.1
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade to the patched version immediately, you can apply the changes from pull request #3644 on GitHub. This involves modifying the code to handle FlateDecode streams more efficiently, thus mitigating the risk of long runtimes.
Conclusion
In summary, the pypdf library has a vulnerability that can lead to long runtimes when processing malformed FlateDecode streams. It is crucial to update to version 6.7.1 or later to mitigate this risk. For those unable to upgrade immediately, applying the changes from the relevant pull request can serve as a temporary workaround.
See every vulnerability recorded for pypdf →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can lead to denial of service, where the application may hang or become unresponsive while processing malicious PDF files.
Yes, version 6.7.1 and later of pypdf contains the fix for this vulnerability and is safe to use.
If you cannot upgrade immediately, consider applying the changes from pull request #3644 to mitigate the risk of long runtimes.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
