{"id":"CVE-2026-33123","title":"pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF (CVE-2026-33123)","summary":"A flaw was found in pypdf, a pure-python PDF library. An attacker can craft a malicious PDF file that, when processed, leads to excessive resource consumption, causing long runtimes and high memory usage. This can result in a Denial of Ser…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":"CWE-770","vendor":"Red Hat","product":"OpenShift Lightspeed","affected":["lightspeed_core","openshift_lightspeed","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai"],"patched":["pypdf 6.9.1"],"published":"2026-03-20","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:35:19+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33123.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33123.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33123"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449585"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33123"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33123"},{"url":"https://github.com/py-pdf/pypdf/pull/3686"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.9.1"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-qpxp-75px-xjcp"},{"url":"https://github.com/py-pdf/pypdf"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00355,"epssPercentile":0.29076,"aliases":["GHSA-qpxp-75px-xjcp","PYSEC-2026-3023"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:58:02.180Z","slug":"CVE-2026-33123","body":"## Overview\n\nA flaw was found in pypdf, a pure-python PDF library. An attacker can craft a malicious PDF file that, when processed, leads to excessive resource consumption, causing long runtimes and high memory usage. This can result in a Denial of Service (DoS) condition, making the application unresponsive or unstable.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33123.json)\n\n**pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF** — rated Moderate by Red Hat. Released 2026-03-20, updated 2026-10-15.\n\nAffected:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-33123)\n\nAffected packages:\n\n- `pypdf < 6.9.1`\n\nPatched in:\n\n- `pypdf 6.9.1`\n\nSource: https://osv.dev/vulnerability/GHSA-qpxp-75px-xjcp","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222182,"id":"CVE-2026-33123","ts":1792065053596,"field":"cvss","old":null,"new":"4.3"}]}