---
id: CVE-2026-27026
title: >-
  pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream
  (CVE-2026-27026)
summary: >-
  A flaw was found in pypdf, a pure-python PDF library. A remote attacker can
  exploit this vulnerability by crafting a malicious PDF file containing a
  malformed /FlateDecode stream. This stream, which is used for data compression
  within the …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-1050
vendor: Red Hat
product: OpenShift Lightspeed
affected:
  - openshift_lightspeed
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
patched:
  - pypdf 6.7.1
published: '2026-02-20'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:34:16+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27026.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27026.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-27026'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2441495'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-27026'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27026'
  - url: >-
      https://github.com/py-pdf/pypdf/commit/7905842d833f899f1d3228af7e7467ad80277016
  - url: 'https://github.com/py-pdf/pypdf/pull/3644'
  - url: 'https://github.com/py-pdf/pypdf/releases/tag/6.7.1'
  - url: 'https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mvc-8737-8j8h'
  - url: 'https://github.com/py-pdf/pypdf'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00191
epssPercentile: 0.08644
aliases:
  - GHSA-9mvc-8737-8j8h
  - PYSEC-2026-3015
ecosystem: pip
ingestedAt: '2026-07-13T18:57:56.017Z'
---

## Overview

A flaw was found in pypdf, a pure-python PDF library. A remote attacker can exploit this vulnerability by crafting a malicious PDF file containing a malformed /FlateDecode stream. This stream, which is used for data compression within the PDF, can cause excessively long processing times when decompressed byte-by-byte. This leads to a Denial of Service (DoS), making the affected system or application unresponsive.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27026.json)

**pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream** — rated Moderate by Red Hat. Released 2026-02-20, updated 2026-10-15.

Affected:

- OpenShift Lightspeed
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- OpenShift Lightspeed
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)

## Remediation

Fix deferred

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

## Package advisory (CVE-2026-27026)

Affected packages:

- `pypdf < 6.7.1`

Patched in:

- `pypdf 6.7.1`

Source: https://osv.dev/vulnerability/GHSA-9mvc-8737-8j8h