Resource exhaustion in PyPDF - CVE-2026-28351
Published: April 27, 2026
Vulnerability identifier: #VU128010
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-28351
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause excessive memory consumption.
The vulnerability exists due to uncontrolled resource consumption in the RunLengthDecode filter when parsing a crafted PDF content stream. A remote attacker can supply a specially crafted PDF to cause excessive memory consumption.
Exploitation requires the application to parse the content stream using the RunLengthDecode filter.
Affected software
PyPDF
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
How to mitigate CVE-2026-28351
Install security update from vendor's website.
PyPDF - update to 6.7.4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2