Memory Exhaustion in PyPDF via Malicious PDF

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value. This issue has been fixed in version 6.13.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-57204

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.13.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the pypdf library, a pure-python PDF library. Before version 6.13.3, it was possible for an attacker to craft a malicious PDF file that causes a denial of service (DoS) by triggering large memory usage. This happens because the library sometimes ignores the MAX_DECLARED_STREAM_LENGTH setting when parsing a content stream that lacks a /Length value.

Impact Analysis

The impact of this vulnerability is a denial of service (DoS) condition. An attacker can exploit it by providing a specially crafted PDF that causes the pypdf library to consume excessive memory, potentially leading to application crashes or degraded performance.

Mitigation Strategies

To mitigate this vulnerability, upgrade the pypdf library to version 6.13.3 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-57204. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70