GHSA-x7hp-r3qg-r3cj
NoneCVSS
—
EPSS
—
Published
Feb 26, 2026
CISA due date
—
The record
pypdf: Manipulated FlateDecode XFA streams can exhaust RAM
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | pypdf | 0 | 6.7.3 |
Related vulnerabilities
- CVE-2026-27888 pypdf is a free and open-source pure-python PDF library. Same vulnerability
- CVE-2026-28804 pypdf is a free and open-source pure-python PDF library. Also affects pypdf
- GHSA-9m86-7pmv-2852 pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams Also affects pypdf
- CVE-2026-28351 pypdf is a free and open-source pure-python PDF library. Also affects pypdf
- GHSA-2rw7-x74f-jg35 pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference… Also affects pypdf
- CVE-2026-27628 pypdf is a free and open-source pure-python PDF library. Also affects pypdf
- CVE-2026-27026 pypdf is a free and open-source pure-python PDF library. Also affects pypdf
- CVE-2026-27025 pypdf is a free and open-source pure-python PDF library. Also affects pypdf