CVE-2026-33123: pypdf Inefficient Decoding of Array-Based Streams
Summary
CVE-2026-33123: pypdf has inefficient decoding of array-based streams. Affects pypdf versions < 6.9.1. Fixed in 6.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypdf is a Python library used for manipulating PDF files. It allows users to create, modify, and extract information from PDF documents. The library is designed to be efficient and user-friendly, making it a popular choice among developers working with PDF files. However, it has been found to have a vulnerability related to the inefficient decoding of array-based streams, which can lead to performance issues.
Vulnerability Detail
The vulnerability arises from the way pypdf handles array-based streams. An attacker can craft a malicious PDF that exploits this inefficiency, leading to prolonged runtimes and excessive memory usage when the PDF is processed. This issue is particularly concerning when dealing with large arrays, as it can significantly degrade application performance and potentially lead to denial-of-service conditions.
How To Fix
Latest published version: 6.21.2 as of 22 Oct 2026
pip install --upgrade "pypdf==6.21.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.9.1
This is the first release that contains the fix.
pip install --upgrade "pypdf==6.9.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can apply the changes from pull request #3686 on GitHub. This involves manually modifying the library's code to mitigate the vulnerability until an official update can be implemented.
Conclusion
In summary, CVE-2026-33123 is a vulnerability in the pypdf library that can lead to performance issues when processing certain PDF files. Users are advised to upgrade to version 6.9.1 or apply the provided workaround to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for pypdf →
FAQ
CVE-2026-33123 is a vulnerability in the pypdf library that allows attackers to exploit inefficient decoding of array-based streams, leading to performance issues.
If your application uses pypdf to process PDFs, it may experience long runtimes and high memory usage when handling maliciously crafted PDF files.
You can apply the changes from pull request #3686 as a temporary workaround until you can upgrade to the patched version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.1, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypdf.
