{"id":"CVE-2026-28804","title":"pypdf: pypdf: Denial of Service via crafted PDF with ASCIIHexDecode filter (CVE-2026-28804)","summary":"A flaw was found in pypdf, a pure-python PDF library. A remote attacker can exploit this vulnerability by crafting a malicious PDF file that utilizes the /ASCIIHexDecode filter. Processing this specially crafted PDF can lead to excessively…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-770","vendor":"Red Hat","product":"OpenShift Lightspeed","affected":["openshift_lightspeed","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai"],"patched":["pypdf 6.7.5"],"published":"2026-03-06","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:34:46+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28804.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28804.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-28804"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445118"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28804"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28804"},{"url":"https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f"},{"url":"https://github.com/py-pdf/pypdf/pull/3666"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.7.5"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852"},{"url":"https://github.com/py-pdf/pypdf"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00415,"epssPercentile":0.35596,"aliases":["GHSA-9m86-7pmv-2852","PYSEC-2026-3014"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:57:56.000Z","slug":"CVE-2026-28804","body":"## Overview\n\nA flaw was found in pypdf, a pure-python PDF library. A remote attacker can exploit this vulnerability by crafting a malicious PDF file that utilizes the /ASCIIHexDecode filter. Processing this specially crafted PDF can lead to excessively long runtimes, resulting in a Denial of Service (DoS) for the application or system processing the file.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28804.json)\n\n**pypdf: pypdf: Denial of Service via crafted PDF with ASCIIHexDecode filter** — rated Moderate by Red Hat. Released 2026-03-06, updated 2026-10-15.\n\nAffected:\n\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, avoid processing untrusted PDF documents with applications that use the pypdf library. If processing untrusted PDFs is unavoidable, consider sandboxing the application responsible for PDF processing to limit potential resource exhaustion.\n\n## Package advisory (CVE-2026-28804)\n\nAffected packages:\n\n- `pypdf < 6.7.5`\n\nPatched in:\n\n- `pypdf 6.7.5`\n\nSource: https://osv.dev/vulnerability/GHSA-9m86-7pmv-2852","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222184,"id":"CVE-2026-28804","ts":1792065055223,"field":"cvss","old":null,"new":"6.5"}]}