CVE-2026-27026

Received Received - Intake

Denial of Service via Malformed /FlateDecode in pypdf

Publication date: 2026-02-20

Last updated on: 2026-02-24

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-20

Last Modified

2026-02-24

Generated

2026-07-06

AI Q&A

2026-02-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27026

Affected Vendors & Products

Vendor	Product	Version / Range
pypdf_project	pypdf	to 6.7.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the pypdf library, a pure-python PDF library. Before version 6.7.1, an attacker could craft a specially malformed PDF containing a /FlateDecode stream that triggers byte-by-byte decompression. This causes the library to experience long runtimes, effectively leading to a denial of service through resource exhaustion.

Impact Analysis

The impact of this vulnerability is that an attacker can cause the pypdf library to consume excessive processing time by providing a malicious PDF. This can lead to performance degradation or denial of service in applications that use pypdf to process PDF files, potentially disrupting normal operations.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the pypdf library to version 6.7.1 or later, where the issue with malformed /FlateDecode streams causing long runtimes has been fixed.

Hi! I’m here to help you understand CVE-2026-27026. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70