CVE-2026-28804: pypdf Vulnerable to Inefficient Decoding of ASCIIHexDecode Streams
Summary
CVE-2026-28804: pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams. Affects pypdf versions < 6.7.5. Fixed in 6.7.5. How to fix ↓
Also tracked for
The same CVE-2026-28804 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library that allows users to manipulate PDF files. It provides functionalities such as reading, writing, and modifying PDF documents. The library is widely used in applications that require PDF processing due to its ease of use and comprehensive feature set. However, it has been identified to have a vulnerability related to the inefficient decoding of ASCIIHexDecode streams, which can lead to performance issues when handling specially crafted PDFs.
Vulnerability Detail
The vulnerability arises from the way pypdf processes streams that utilize the ASCIIHexDecode filter. An attacker can exploit this vulnerability by crafting a malicious PDF that, when processed, results in excessively long runtimes. This can lead to denial of service conditions, as the application may hang or become unresponsive while attempting to decode the affected streams. The vulnerability is classified under CWE-407, indicating that it can lead to resource exhaustion.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.7.5
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.7.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to apply the changes from the pull request #3666 on the pypdf GitHub repository. This involves modifying the decoding logic to handle ASCIIHexDecode streams more efficiently.
Conclusion
The pypdf library has a vulnerability (CVE-2026-28804) that affects its handling of ASCIIHexDecode streams, potentially leading to denial of service. Users are advised to upgrade to version 6.7.5 or apply the suggested workaround to mitigate the issue. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for pypdf →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary consequence is that an attacker can create a PDF that causes the application to hang or crash, leading to denial of service.
Yes, you should upgrade to pypdf version 6.7.5 or later to mitigate this vulnerability.
ASCIIHexDecode is a filter used in PDF streams to encode binary data in a hexadecimal format. This vulnerability specifically affects how pypdf decodes such streams, leading to performance issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
