CVE-2026-27888: pypdf Memory Exhaustion Vulnerability via Manipulated FlateDecode XFA Streams
Summary
CVE-2026-27888: pypdf: Manipulated FlateDecode XFA streams can exhaust RAM. Affects pypdf versions < 6.7.3. Fixed in 6.7.3. How to fix ↓
Also tracked for
The same CVE-2026-27888 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library used for manipulating PDF files. It allows users to read, write, and modify PDF documents with ease. The library supports various features such as merging, splitting, and extracting text from PDFs. However, it has a vulnerability that can be exploited when handling XFA streams compressed with FlateDecode, potentially leading to excessive memory consumption.
Vulnerability Detail
The vulnerability arises from the way pypdf processes XFA streams that are compressed using FlateDecode. An attacker can craft a malicious PDF that, when processed, causes the application to exhaust available RAM. This can lead to denial of service, as the application may become unresponsive or crash due to memory exhaustion. The issue is particularly concerning for applications that handle untrusted PDF files, as it opens the door for attackers to exploit this weakness.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.7.3
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.7.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can apply the changes from pull request #3658 on the pypdf GitHub repository. This involves manually modifying the code to mitigate the vulnerability until an upgrade can be performed.
Conclusion
The CVE-2026-27888 vulnerability in the pypdf library poses a significant risk by allowing attackers to exhaust system memory through manipulated PDF files. Users are strongly advised to upgrade to version 6.7.3 or apply the provided workaround to protect their applications from potential exploitation.
See every vulnerability recorded for pypdf →
FAQ
CVE-2026-27888 is a vulnerability in the pypdf library that allows attackers to exhaust system memory by manipulating FlateDecode XFA streams in PDF files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any signup.
The primary consequence is denial of service due to memory exhaustion, which can cause applications to crash or become unresponsive when processing malicious PDF files.
Yes, the vulnerability has been patched in pypdf version 6.7.3. Users are encouraged to upgrade to this version to mitigate the risk.
If an immediate upgrade is not feasible, consider applying the changes from pull request #3658 as a temporary workaround until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
