📄 pypdf Memory Exhaustion / Denial of Service

pypdf versions prior to 6.7.3 were vulnerable to a denial of service condition caused by uncontrolled memory allocation during decompression of XFA streams. An attacker could craft a malicious PDF file containing a highly compressed stream using /FlateDecode...

CVE-2026-27888

creationtimestamp| type| source ---|---|--- 2026-02-26 02:25:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfq5e5qc2u2u 2026-02-26 20:40:19+00:00| seen| https://gist.github.com/alon710/46cb981f7572074584ce82b41bf22f76 2026-02-28 10:11:10+00:00| seen|...

CVE-2026-27888

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode...

CVE-2026-27888

CVE-2026-27888 affects the pypdf library (Python) prior to 6.7.3. The issue arises when an attacker crafts a PDF that causes RAM exhaustion by accessing the reader/writer’s xfa property and a compressed stream using FlateDecode, leading to high availability impact. The vulnerability does not disc...