CVE-2026-102997

Received Received - Intake

Denial of Service in pypdf via FlateDecode Stream

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102997

EUVD

EUVD-2026-90373

Affected Vendors & Products

Vendor	Product	Version / Range
py-pdf	pypdf	to 6.18.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability affects the pypdf library, a Python tool for handling PDF files. A specially crafted PDF with a malformed /FlateDecode stream can cause the library to use slow byte-by-byte decompression, leading to long processing times and potential application crashes. The issue was partially fixed but left a residual problem that still allows this attack.

Detection Guidance

This vulnerability is specific to the pypdf library and involves crafted PDF files with malformed /FlateDecode streams. Detection requires checking for pypdf versions prior to 6.18.1 and analyzing PDF files for unusual decompression behavior. No direct network or system commands are provided in the context to detect this issue.

Impact Analysis

If you process untrusted PDF files using pypdf versions before 6.18.1, an attacker could send a malicious PDF to cause high CPU usage or freeze your application, leading to denial of service. This could disrupt services relying on PDF processing.

Mitigation Strategies

Upgrade pypdf to version 6.18.1 or later to address the vulnerability. Review and update any applications using pypdf to ensure they are not affected by malformed PDF files.

Hi! I’m here to help you understand CVE-2026-102997. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70