{"id":"CVE-2026-27888","title":"pypdf: pypdf: Denial of Service via crafted PDF (CVE-2026-27888)","summary":"A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF document. When a user processes this specially crafted PDF, it can lead to excessive memory consumption, resulting in a Denial of Servi…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":"CWE-1050","vendor":"Red Hat","product":"OpenShift Lightspeed","affected":["openshift_lightspeed","openshift_ai 2.25"],"patched":["openshift_ai 2.25"],"published":"2026-02-26","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:34:33+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27888.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27888.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-27888"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442899"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27888"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27888"},{"url":"https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c"},{"url":"https://github.com/py-pdf/pypdf/pull/3658"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.7.3"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"url":"https://github.com/py-pdf/pypdf"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00399,"epssPercentile":0.33946,"aliases":["GHSA-x7hp-r3qg-r3cj","PYSEC-2026-3027"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:58:05.037Z","slug":"CVE-2026-27888","body":"## Overview\n\nA flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF document. When a user processes this specially crafted PDF, it can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected system. This issue specifically arises when the `xfa` property of a PDF reader or writer is accessed and its corresponding stream is compressed using `/FlateDecode`.\n\n## Vendor advisories\n\n- **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184)\n- **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed · no fix planned: OpenShift Lightspeed · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27888.json)\n\n**pypdf: pypdf: Denial of Service via crafted PDF** — rated Moderate by Red Hat. Released 2026-02-26, updated 2026-10-15.\n\nAffected:\n\n- OpenShift Lightspeed\n\nFixed:\n\n- Red Hat OpenShift AI 2.25\n\nNo fix planned:\n\n- OpenShift Lightspeed\n\nNot affected:\n\n- Red Hat OpenShift AI 2.25\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\n## Remediation\n\nFor Red Hat OpenShift AI 2.25.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:10184\n\n## Package advisory (CVE-2026-27888)\n\nAffected packages:\n\n- `pypdf < 6.7.3`\n\nPatched in:\n\n- `pypdf 6.7.3`\n\nSource: https://osv.dev/vulnerability/GHSA-x7hp-r3qg-r3cj","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222187,"id":"CVE-2026-27888","ts":1792065057431,"field":"cvss","old":null,"new":"5.3"}]}