CVE-2026-31826: pypdf Memory Exhaustion Vulnerability Due to Manipulated Stream Lengths
Summary
CVE-2026-31826: pypdf: manipulated stream length values can exhaust RAM. Affects pypdf versions < 6.8.0. Fixed in 6.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library designed for reading and manipulating PDF files. It provides functionalities such as extracting text, merging documents, and modifying PDF content. However, it is vulnerable to a specific issue where an attacker can craft a PDF file that leads to excessive memory usage, potentially exhausting system resources.
Vulnerability Detail
The vulnerability arises from the handling of content streams in PDF files, specifically when a stream has a manipulated '/Length' value that does not correspond to the actual data length. This can lead to significant memory consumption when parsing such streams, making the application susceptible to denial-of-service attacks. Attackers can exploit this vulnerability by creating specially crafted PDF files that cause the pypdf library to allocate large amounts of memory, which can lead to application crashes or slowdowns.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.8.0
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can apply the changes from pull request #3675 on GitHub. This involves modifying the way pypdf handles content streams to mitigate the risk of memory exhaustion. Alternatively, avoid reading from buffers of unknown size, such as those returned by open('file.pdf', mode='rb'). Instead, use a file path or a BytesIO buffer to prevent triggering the vulnerability.
Conclusion
CVE-2026-31826 represents a significant vulnerability in the pypdf library, allowing for potential memory exhaustion through crafted PDF files. Users are encouraged to update to the latest version to protect their applications from this risk. For those unable to upgrade immediately, workarounds are available to mitigate the threat.
See every vulnerability recorded for pypdf →
FAQ
CVE-2026-31826 is a vulnerability in the pypdf library that allows attackers to craft PDF files with manipulated stream lengths, leading to excessive memory usage.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground without signup to test your application.
Exploiting this vulnerability can lead to denial-of-service conditions, where the application consumes excessive memory, potentially crashing or slowing down the system.
Yes, the vulnerability has been patched in pypdf version 6.8.0. It is recommended to upgrade to this version to mitigate the risk.
If you cannot upgrade, consider applying the changes from pull request #3675 or avoid reading from buffers of unknown size to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
