CVE-2026-27888Medium· 5.3▾ SunlitA flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF document. When a user processes this specially crafted PDF, it can lead to excessive memory consumption, resulting in a Denial of Servi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
— → 5.3
0.3% → 0.7%
A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF document. When a user processes this specially crafted PDF, it can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected system. This issue specifically arises when the xfa property of a PDF reader or writer is accessed and its corresponding stream is compressed using /FlateDecode.
pypdf: pypdf: Denial of Service via crafted PDF — rated Moderate by Red Hat. Released 2026-02-26, updated 2026-10-15.
Affected:
Fixed:
No fix planned:
Not affected:
For Red Hat OpenShift AI 2.25.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:10184
Affected packages:
pypdf < 6.7.3Patched in:
pypdf 6.7.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27025Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with large font values (CVE-2026-27025)
CVE-2026-27026Medium· 6.5pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream (CVE-2026-27026)
CVE-2026-59937Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with malformed cross-reference streams (CVE-2026-59937)
CVE-2026-33123Medium· 4.3pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF (CVE-2026-33123)
CVE-2026-31826Medium· 6.5pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF (CVE-2026-31826)
CVE-2026-28351Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with RunLengthDecode filter (CVE-2026-28351)