CVE-2026-27026Medium· 6.5▾ Sunlit

pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream (CVE-2026-27026)

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Feb 20, 2026

Updated

Oct 15, 2026

CVSS

6.5

Vendor

Red Hat

Product

OpenShift Lightspeed

CWE

CWE-1050

Depth score

36 · Low

EPSS

0.19% · p9

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Aug 3.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 241 days

Feb 20, 2026Published
Disclosed via CSAF
Aug 3, 2026EPSS first tracked
0.2%
Oct 15, 2026Record revised
Last analysed / modified upstream
Oct 15, 2026CVSS changed
— → 6.5
Oct 19, 2026EPSS peak
0.2% → 0.2%

Red Hat CWE-1050 #csaf #vex #red-hat #osv #pip

Affected

Patched in

pypdf 6.7.1

Full technical detail▾

Overview

A flaw was found in pypdf, a pure-python PDF library. A remote attacker can exploit this vulnerability by crafting a malicious PDF file containing a malformed /FlateDecode stream. This stream, which is used for data compression within the PDF, can cause excessively long processing times when decompressed byte-by-byte. This leads to a Denial of Service (DoS), making the affected system or application unresponsive.

Vendor advisories

Red Hat VEX · Moderate · affected: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · vex

pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream — rated Moderate by Red Hat. Released 2026-02-20, updated 2026-10-15.

Affected:

OpenShift Lightspeed
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat OpenShift AI (RHOAI)

No fix planned:

OpenShift Lightspeed
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat OpenShift AI (RHOAI)

Remediation

Fix deferred

Workarounds / mitigations:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Package advisory (CVE-2026-27026)

Affected packages:

pypdf < 6.7.1

Patched in:

pypdf 6.7.1

Source: https://osv.dev/vulnerability/GHSA-9mvc-8737-8j8h

References

Change history

Field changes observed since this record was first indexed.

Oct 15, 2026CVSS — → 6.5

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#pip

← Back to feed