CVE-2026-28351: pypdf Memory Exhaustion via Manipulated RunLengthDecode Streams
Summary
CVE-2026-28351: pypdf: Manipulated RunLengthDecode streams can exhaust RAM. Affects pypdf versions < 6.7.4. Fixed in 6.7.4. How to fix ↓
Also tracked for
The same CVE-2026-28351 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library that allows for the manipulation and creation of PDF files. It provides functionalities such as reading, writing, and modifying PDF documents. The library is widely used in applications that require PDF processing due to its ease of use and comprehensive feature set. However, it is susceptible to vulnerabilities that can be exploited by attackers, particularly through the handling of specific content streams.
Vulnerability Detail
The vulnerability identified as CVE-2026-28351 arises from the way pypdf handles RunLengthDecode streams. An attacker can craft a malicious PDF that, when processed, leads to excessive memory consumption. This can result in denial of service conditions, as the application may exhaust available RAM, potentially crashing or slowing down the system. The issue is rooted in the parsing logic of the RunLengthDecode filter, which does not adequately limit memory usage when processing specially crafted input.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.7.4
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.7.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can apply the changes from pull request #3664 on the pypdf GitHub repository. This involves manually modifying the code to implement safeguards against excessive memory usage when handling RunLengthDecode streams.
Conclusion
In summary, CVE-2026-28351 is a significant vulnerability in the pypdf library that can lead to memory exhaustion through maliciously crafted PDFs. Users are advised to upgrade to the latest version to mitigate this risk. For those unable to upgrade immediately, applying the suggested workaround can provide temporary relief.
See every vulnerability recorded for pypdf →
FAQ
CVE-2026-28351 is a vulnerability in the pypdf library that allows attackers to create PDFs that can exhaust system memory, leading to potential denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The vulnerability has a CVSS score of 6.9, indicating a moderate level of severity.
If you cannot upgrade, consider applying the changes from pull request #3664 to mitigate the risk until you can update to the patched version.
You can find more information about pypdf and its functionalities on its official GitHub repository and documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
