CVE-2026-49461: Pypdf_project Pypdf DOS Vulnerability

CVE-2026-49461 Overview

CVE-2026-49461 is a resource exhaustion vulnerability in pypdf, a pure-Python PDF library widely used for reading, manipulating, and extracting content from PDF files. An attacker can craft a malicious PDF that triggers excessive memory consumption when an application calls pypdf's text extraction function on a page containing a form XObject with self-references. The recursive resolution of the self-referencing XObject causes pypdf to repeatedly process the same object, leading to unbounded memory growth. The issue is fixed in pypdf version 6.12.2. The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A single crafted PDF can exhaust memory on any process invoking pypdf text extraction, disrupting document processing pipelines and PDF-handling services.

Affected Products

pypdf versions prior to 6.12.2
Python applications using pypdf for text extraction
Document processing pipelines that ingest untrusted PDFs through pypdf

Discovery Timeline

2026-06-22 - CVE-2026-49461 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-49461

Vulnerability Analysis

The vulnerability resides in pypdf's text extraction logic when handling form XObjects. A form XObject is a self-contained PDF content stream that can be referenced by pages and other XObjects. When a form XObject references itself, either directly or through a cycle, pypdf's extraction routine does not detect the cycle and continues to resolve and process the reference. Each resolution allocates additional memory for the same content, and the process grows until the host exhausts available memory. Applications running pypdf in long-lived workers, web services, or batch pipelines may crash or trigger out-of-memory conditions on the host system.

Root Cause

The root cause is missing cycle detection during form XObject resolution in the page text extraction path. The library treats each XObject reference as a fresh object to expand, without tracking which objects are already on the resolution stack. This is a classic [CWE-400] uncontrolled resource consumption pattern, where an attacker controls the structure of input data and uses it to drive the parser into pathological memory behavior.

Attack Vector

Exploitation requires that a victim application invoke text extraction on a page from an attacker-supplied PDF. The attack vector is local in CVSS terms because the attacker delivers a file that must be processed by the target, rather than reaching pypdf over a network protocol directly. In practice, however, the file can be supplied through any channel that ultimately reaches pypdf, including email attachments, document upload endpoints, indexers, and OCR pipelines. No authentication or user interaction beyond ingesting the file is required for the parser to begin processing the malicious structure.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-j543-4vmf-qm7v and the fix is available in the pypdf 6.12.2 release.

Detection Methods for CVE-2026-49461

Indicators of Compromise

Python processes hosting pypdf showing rapid resident memory growth after a PDF is loaded for text extraction.
Out-of-memory kills (oom-killer events on Linux) correlated with pypdf worker processes.
Document processing queues stalling or restarting repeatedly when processing a specific PDF file.
PDF files in ingest storage containing form XObjects that reference their own object number.

Detection Strategies

Inventory dependencies across Python services and identify any pypdf version earlier than 6.12.2 using pip list or software composition analysis tools.
Add runtime memory ceilings to PDF processing workers so that anomalous growth is logged before the host is impacted.
Statically scan stored PDFs for form XObject definitions that reference their own object identifier as a child resource.

Monitoring Recommendations

Monitor per-process memory metrics for services that call PageObject.extract_text() and alert on sustained growth above expected baselines.
Log PDF file hashes and source identifiers at ingest so that any file linked to a crash can be quickly correlated and quarantined.
Track kernel OOM events and container restart counts on PDF processing nodes through your centralized logging or SIEM platform.

How to Mitigate CVE-2026-49461

Immediate Actions Required

Upgrade pypdf to version 6.12.2 or later in all environments that process untrusted PDF input.
Audit Python virtual environments, container images, and lock files for transitive pypdf dependencies pinned to older releases.
Quarantine any PDF that has triggered an out-of-memory event pending analysis.

Patch Information

The issue is fixed in pypdf 6.12.2. Upgrade with pip install --upgrade pypdf>=6.12.2. Review the pull request that introduced the fix for implementation details and the 6.12.2 release notes for the full changelog.

Workarounds

Run pypdf extraction in isolated worker processes with hard memory limits using resource.setrlimit(RLIMIT_AS, ...) on Linux or container memory limits in orchestrated environments.
Enforce a maximum execution timeout on text extraction calls so that a single malicious PDF cannot indefinitely consume a worker.
Reject or sandbox PDFs from untrusted sources until the upgrade to 6.12.2 is deployed across all processing nodes.

bash

# Configuration example: upgrade pypdf and verify the installed version
pip install --upgrade 'pypdf>=6.12.2'
python -c "import pypdf; print(pypdf.__version__)"