CVE-2026-27026: Pypdf_project Pypdf DOS Vulnerability

CVE-2026-27026 Overview

CVE-2026-27026 is a Denial of Service vulnerability affecting pypdf, a free and open-source pure-python PDF library. Prior to version 6.7.1, an attacker can craft a malicious PDF document that leads to extremely long processing times when parsed by the library. This occurs through a malformed /FlateDecode stream where byte-by-byte decompression is triggered, causing resource exhaustion and application hangs.

Critical Impact
Applications using vulnerable versions of pypdf may become unresponsive when processing attacker-controlled PDF files, leading to denial of service conditions that affect availability of dependent services.

Affected Products

pypdf versions prior to 6.7.1
Applications and services using pypdf for PDF parsing
Python environments with vulnerable pypdf installations

Discovery Timeline

2026-02-20 - CVE CVE-2026-27026 published to NVD
2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-27026

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The root issue lies in pypdf's FlateDecode filter implementation, which handles decompression of zlib-compressed PDF streams. When encountering malformed compressed data, the library falls back to a byte-by-byte decompression recovery mechanism without adequate limits on processing attempts.

An attacker can exploit this by crafting a PDF containing a specially malformed /FlateDecode stream. When pypdf attempts to decompress this stream, the fallback decompression loop processes input byte-by-byte without restrictions, resulting in algorithmic complexity that can cause the application to hang for extended periods.

Root Cause

The vulnerability stems from missing input length validation in the FlateDecode recovery path. When standard zlib decompression fails on malformed data, pypdf's fallback mechanism processes the stream incrementally without enforcing a maximum input length threshold. This allows an attacker to provide arbitrarily large or complex malformed streams that trigger exponential processing time.

Attack Vector

The attack vector is local, requiring an attacker to provide a malicious PDF file to an application using the vulnerable pypdf library. This could occur through:

File upload functionality in web applications
Email attachment processing systems
Document management platforms
Any service that accepts and parses user-supplied PDF files

The attack does not require authentication or user interaction beyond providing the malicious file to a vulnerable system.

python

# Security patch in pypdf/filters.py - SEC: Limit FlateDecode recovery attempts (#3644)
 JBIG2_MAX_OUTPUT_LENGTH = 75_000_000
 LZW_MAX_OUTPUT_LENGTH = 75_000_000
 ZLIB_MAX_OUTPUT_LENGTH = 75_000_000
+ZLIB_MAX_RECOVERY_INPUT_LENGTH = 5_000_000
 
+# Reuse cached 1-byte values in the fallback loop to avoid per-byte allocations.
+_SINGLE_BYTES = tuple(bytes((i,)) for i in range(256))
 
 
 def _decompress_with_limit(data: bytes) -> bytes:

Source: GitHub Commit Update

Detection Methods for CVE-2026-27026

Indicators of Compromise

Abnormally long PDF processing times in applications using pypdf
High CPU utilization during PDF parsing operations without corresponding output
Application hangs or timeouts when processing specific PDF documents
Memory consumption spikes during PDF decompression operations

Detection Strategies

Monitor application logs for timeout errors during PDF processing
Implement processing time limits and alerts for PDF parsing operations exceeding normal thresholds
Use dependency scanning tools to identify pypdf versions below 6.7.1
Audit software bill of materials (SBOM) for vulnerable pypdf installations

Monitoring Recommendations

Configure CPU and memory usage alerts for services processing PDF files
Implement request timeout monitoring for file upload endpoints
Track pypdf version deployment across environments using software composition analysis (SCA) tools
Set up logging for decompression failures that may indicate exploitation attempts

How to Mitigate CVE-2026-27026

Immediate Actions Required

Upgrade pypdf to version 6.7.1 or later immediately
Audit all applications and services using pypdf for vulnerable versions
Implement file size limits for PDF uploads to reduce attack surface
Consider implementing processing timeouts for PDF parsing operations as defense in depth

Patch Information

The vulnerability is fixed in pypdf version 6.7.1. The patch introduces a ZLIB_MAX_RECOVERY_INPUT_LENGTH constant set to 5,000,000 bytes, which limits the input size processed during FlateDecode recovery operations. Additionally, the patch optimizes the fallback loop by caching single-byte values to avoid per-byte allocations.

For detailed patch information, see the GitHub Pull Request and GitHub Security Advisory GHSA-9mvc-8737-8j8h.

Workarounds

Implement processing timeouts at the application level to terminate long-running PDF operations
Pre-validate PDF files using alternative tools before processing with pypdf
Restrict PDF uploads to trusted sources where possible
Isolate PDF processing in sandboxed environments with resource limits

bash

# Configuration example
# Upgrade pypdf to patched version
pip install --upgrade pypdf>=6.7.1

# Verify installed version
pip show pypdf | grep Version