CVE-2026-102997

HIGHCVSS 7.5

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.

Timeline

Published:September 30th, 2026 9:17 PM

Last modified:November 2nd, 2026 4:06 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Software

From NVD CPE configuration data

Vendors

py-pdf

Products

pypdf

Weaknesses (CWE)

CWE-400 CWE-407

References & Reports

Advisories, patches, and third-party reports

https://github.com/py-pdf/pypdf/commit/d9d38cf99b115deb562d3b68f36c33027bc04f79Patch
https://github.com/py-pdf/pypdf/pull/4073Patch
https://github.com/py-pdf/pypdf/releases/tag/6.18.1Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-jw7q-gvrg-4vj3Vendor Advisory

Source: NIST NVD · Data may lag official sources by up to one minute