Allocation of Resources Without Limits or Throttling in PyPDF - CVE-2026-31826
Published: April 27, 2026
Vulnerability identifier: #VU128011
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-31826
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the content stream parser when parsing a PDF content stream with a manipulated /Length value. A remote attacker can craft a PDF with a large /Length value to cause a denial of service.
This issue primarily affects cases where the library reads from buffers of unknown size, such as file objects opened in binary mode.
Affected software
PyPDF
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
How to mitigate CVE-2026-31826
Install security update from vendor's website.
PyPDF - update to 6.8.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2