CVE-2025-55197: Pypdf_project Pypdf DOS Vulnerability

CVE-2025-55197 Overview

CVE-2025-55197 is a resource exhaustion vulnerability affecting pypdf, a free and open-source pure-Python PDF library. Prior to version 6.0.0, an attacker can craft a malicious PDF file that causes complete RAM exhaustion when the file is processed. This denial of service condition occurs when a series of FlateDecode filters is applied to a malicious cross-reference stream, requiring only that the file be read to trigger the vulnerability. Other content streams may also be affected upon explicit access.

Critical Impact

Applications using vulnerable versions of pypdf may become unresponsive or crash when processing maliciously crafted PDF files, leading to denial of service conditions that can affect availability of PDF processing services and applications.

Affected Products

• pypdf_project pypdf versions prior to 6.0.0
• Applications and services integrating pypdf for PDF parsing
• Python-based document processing pipelines using vulnerable pypdf versions

Discovery Timeline

• 2025-08-13 - CVE-2025-55197 published to NVD
• 2025-08-15 - Last updated in NVD database

Technical Details for CVE-2025-55197

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), a denial of service condition that exploits the FlateDecode filter processing mechanism within pypdf. The vulnerability allows remote attackers to cause memory exhaustion without authentication, requiring no user interaction beyond opening or processing the malicious PDF file.

The attack surface is network-accessible, meaning any application that processes PDF files from untrusted sources (such as web applications, email attachment scanners, or document management systems) is potentially vulnerable. The impact is limited to availability—no confidentiality or integrity violations occur—but the ease of exploitation and potential for disruption make this a notable security concern for production environments.

Root Cause

The root cause lies in the pypdf.filters.decompress function, specifically in how the library handles recursive or chained FlateDecode filter operations. The vulnerable code path exists in the filters.py file (lines 72-143 in the affected version). When processing a malicious cross-reference stream with specially crafted FlateDecode filters, the library fails to properly limit resource consumption, allowing decompression operations to consume unbounded amounts of memory.

The lack of proper bounds checking or resource limits on the decompression process means that an attacker can construct a PDF where the decompression ratio is extremely high, causing the allocated memory to grow until the system's available RAM is exhausted.

Attack Vector

The attack is network-accessible and can be executed by delivering a malicious PDF file to any application using a vulnerable version of pypdf. The exploitation is straightforward:

1. An attacker crafts a PDF with a malicious cross-reference stream containing nested or recursive FlateDecode filters
2. The PDF is delivered to a target application (via email, web upload, API endpoint, etc.)
3. When the application reads or processes the PDF using pypdf, the decompression triggers
4. Memory consumption grows rapidly, exhausting available RAM
5. The application becomes unresponsive or crashes, causing denial of service

The vulnerability requires no authentication, no user interaction beyond normal PDF processing, and has low attack complexity. For further technical details, refer to the GitHub Issue #3429 and the vulnerable code section in filters.py.

Detection Methods for CVE-2025-55197

Indicators of Compromise

• Sudden memory spikes or out-of-memory conditions when processing PDF files
• Application crashes or timeouts specifically during PDF parsing operations
• PDF files with unusually complex or deeply nested FlateDecode filter chains in cross-reference streams
• Process termination events correlating with PDF upload or processing activities

Detection Strategies

• Monitor pypdf library versions across all Python environments and flag installations below 6.0.0
• Implement memory usage thresholds and alerts for PDF processing services
• Deploy file inspection tools to analyze incoming PDF files for malformed or suspicious FlateDecode filter structures
• Review application logs for recurring memory-related failures during PDF operations

Monitoring Recommendations

• Set up resource consumption monitoring for services that process PDF files from untrusted sources
• Configure alerting for memory usage anomalies in Python application processes
• Implement logging for PDF file metadata to help identify potentially malicious files post-incident
• Consider sandboxing PDF processing operations with memory limits to contain potential exploitation

How to Mitigate CVE-2025-55197

Immediate Actions Required

• Upgrade pypdf to version 6.0.0 or later immediately across all affected systems
• Audit all Python environments for pypdf dependencies using pip list or dependency scanning tools
• Implement input validation and file size limits on PDF uploads as a defense-in-depth measure
• Consider temporarily disabling PDF processing from untrusted sources until patches are applied

Patch Information

The vulnerability has been fixed in pypdf version 6.0.0. The fix addresses the unbounded memory consumption in the FlateDecode filter processing logic. Users should upgrade using:

pip install --upgrade pypdf>=6.0.0

For detailed information about the patch, see the GitHub Pull Request #3430 and the Release Notes for version 6.0.0. The Security Advisory GHSA-7hfw-26vp-jp8m provides additional context and remediation guidance.

Workarounds

• If upgrading is not immediately possible, apply the fixed code from pypdf.filters.decompress manually to your existing filters file
• Implement memory limits on processes that handle PDF parsing using OS-level controls (cgroups, ulimit)
• Sandbox PDF processing in isolated containers with strict resource quotas
• Pre-screen uploaded PDF files with alternative tools before pypdf processing

# Example: Set memory limits for PDF processing container
docker run --memory="512m" --memory-swap="512m" your-pdf-processor:latest

# Example: Verify pypdf version
pip show pypdf | grep Version