CVE-2026-49460 Overview
CVE-2026-49460 is an algorithmic complexity vulnerability in pypdf, a free and open-source pure-Python PDF library. Versions prior to 6.12.2 allow an attacker to craft a malicious PDF that triggers excessive runtime when the library processes a stream using the /FlateDecode filter combined with a PNG predictor. The flaw is categorized under [CWE-407: Inefficient Algorithmic Complexity]. Applications that parse untrusted PDF documents using pypdf can experience denial of service through CPU exhaustion. The maintainers fixed the issue in version 6.12.2.
Critical Impact
Attackers can submit a malicious PDF to any service using pypdf and force long-running parsing operations that exhaust CPU resources and degrade availability.
Affected Products
- pypdf versions prior to 6.12.2
- Python applications and services using pypdf to parse untrusted PDF input
- Document processing pipelines that decode /FlateDecode streams with PNG predictors
Discovery Timeline
- 2026-06-22 - CVE-2026-49460 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-49460
Vulnerability Analysis
The vulnerability resides in the stream decoding path of pypdf. PDF streams can be compressed using the /FlateDecode filter, which applies zlib decompression. The filter accepts an optional /Predictor parameter that selects a row-prediction algorithm originally designed for PNG image compression. When the predictor is set to a PNG predictor value (10-15), pypdf performs additional per-row computations to reverse the prediction.
A crafted PDF can manipulate the stream parameters so that the decoded data and predictor processing consume disproportionate CPU time relative to the input size. This places the issue squarely in the inefficient algorithmic complexity category [CWE-407]. The result is a denial of service against any process that opens the malicious document.
Root Cause
The root cause is insufficient validation and bounded processing in the PNG predictor handler used after /FlateDecode decompression. The decoder did not enforce limits that would prevent pathological inputs from driving extended computation. Refer to the GitHub Security Advisory GHSA-5hgr-hg42-57jg for the authoritative description.
Attack Vector
Exploitation requires the victim application to process a PDF supplied by the attacker. The CVSS vector indicates a local attack vector with low complexity and no privileges or user interaction required. In practice, any pipeline that ingests PDFs from external sources, such as document upload portals, mail gateways, or batch converters, can be reached by submitting the crafted file. The impact is limited to availability; confidentiality and integrity are not affected. See the pypdf Pull Request #3806 for the fix details.
Detection Methods for CVE-2026-49460
Indicators of Compromise
- Python worker processes consuming sustained high CPU while parsing PDF documents.
- PDF files containing /Filter /FlateDecode combined with /Predictor values between 10 and 15 that decode to suspiciously large or repetitive payloads.
- Increased latency, timeouts, or worker restarts in PDF ingestion services after receiving specific user-supplied files.
Detection Strategies
- Inventory Python environments and identify pypdf versions below 6.12.2 using pip list or software composition analysis tooling.
- Inspect inbound PDF streams for /FlateDecode filters paired with PNG predictor dictionaries and flag anomalously high decoded-to-encoded size ratios.
- Add runtime timeouts around pypdf parsing calls and log files that exceed expected processing durations.
Monitoring Recommendations
- Monitor CPU utilization and process runtime for services that invoke pypdf.PdfReader on user-supplied content.
- Capture and retain samples of PDFs that cause parser timeouts for offline forensic review.
- Alert on repeated upload patterns from a single source that correlate with parser slowdowns or worker crashes.
How to Mitigate CVE-2026-49460
Immediate Actions Required
- Upgrade pypdf to version 6.12.2 or later across all Python environments that parse untrusted PDFs.
- Audit dependency manifests such as requirements.txt, pyproject.toml, and lock files for transitive uses of vulnerable pypdf versions.
- Enforce per-request CPU and wall-clock timeouts on PDF parsing workers to bound the impact of malformed inputs.
Patch Information
The maintainers released the fix in pypdf 6.12.2. See the pypdf 6.12.2 Release Notes and the merged Pull Request #3806 for the code change that constrains predictor processing.
Workarounds
- Run PDF parsing in isolated worker processes with strict CPU and memory limits using ulimit, container quotas, or cgroups.
- Reject or pre-scan PDFs whose /FlateDecode streams declare PNG predictor values when the source is untrusted.
- Apply file-size and processing-time ceilings at the application layer to prevent a single document from monopolizing resources.
# Configuration example
pip install --upgrade "pypdf>=6.12.2"
pip show pypdf | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
