Inefficient Algorithmic Complexity in PyPDF - #VU156727
Published: October 21, 2026
Vulnerability identifier: #VU156727
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through excessive PDF processing times.
The vulnerability exists due to inefficient algorithmic complexity in pypdf's cross-reference stream processing when parsing PDFs containing repeated malformed cross-reference entries. A remote attacker can craft a PDF that triggers repeated loading of the entire stream despite an existing cache to prolong processing and reduce application availability.
Affected software
PyPDF
Remediation
Install security update from vendor's website.
PyPDF - update to 6.21.2