---
id: CVE-2026-31826
title: >-
  pypdf: pypdf: Denial of Service due to excessive memory consumption via
  crafted PDF (CVE-2026-31826)
summary: >-
  A flaw was found in pypdf, a pure-Python PDF library. An attacker can craft a
  malicious PDF file containing a content stream with an intentionally large
  /Length value. When this PDF is parsed, it can lead to excessive memory
  consumption, r…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-770
vendor: Red Hat
product: OpenShift Lightspeed
affected:
  - openshift_lightspeed
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
patched:
  - pypdf 6.8.0
published: '2026-03-10'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:34:48+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31826.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31826.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-31826'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2446336'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-31826'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31826'
  - url: 'https://github.com/py-pdf/pypdf/pull/3675'
  - url: 'https://github.com/py-pdf/pypdf/releases/tag/6.8.0'
  - url: 'https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7'
  - url: >-
      https://github.com/py-pdf/pypdf/commit/3c550b3196adeba1506a26e57c09c09fac75e9aa
  - url: 'https://github.com/py-pdf/pypdf'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00183
epssPercentile: 0.07791
aliases:
  - GHSA-hqmh-ppp3-xvm7
  - PYSEC-2026-3019
ecosystem: pip
ingestedAt: '2026-07-13T18:57:59.353Z'
---

## Overview

A flaw was found in pypdf, a pure-Python PDF library. An attacker can craft a malicious PDF file containing a content stream with an intentionally large /Length value. When this PDF is parsed, it can lead to excessive memory consumption, resulting in a Denial of Service (DoS) condition due to resource exhaustion.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31826.json)

**pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF** — rated Moderate by Red Hat. Released 2026-03-10, updated 2026-10-15.

Affected:

- OpenShift Lightspeed
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- OpenShift Lightspeed
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)

## Remediation

Fix deferred

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

## Package advisory (CVE-2026-31826)

Affected packages:

- `pypdf < 6.8.0`

Patched in:

- `pypdf 6.8.0`

Source: https://osv.dev/vulnerability/GHSA-hqmh-ppp3-xvm7