CVE-2026-27026
Received Received - Intake
Denial of Service via Malformed /FlateDecode in pypdf

Publication date: 2026-02-20

Last updated on: 2026-02-24

Assigner: GitHub, Inc.

Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-20
Last Modified
2026-02-24
Generated
2026-06-16
AI Q&A
2026-02-21
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27026
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
pypdf_project pypdf to 6.7.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the pypdf library, a pure-python PDF library. Before version 6.7.1, an attacker could craft a specially malformed PDF containing a /FlateDecode stream that triggers byte-by-byte decompression. This causes the library to experience long runtimes, effectively leading to a denial of service through resource exhaustion.

Impact Analysis

The impact of this vulnerability is that an attacker can cause the pypdf library to consume excessive processing time by providing a malicious PDF. This can lead to performance degradation or denial of service in applications that use pypdf to process PDF files, potentially disrupting normal operations.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the pypdf library to version 6.7.1 or later, where the issue with malformed /FlateDecode streams causing long runtimes has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27026. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart