CVE-2026-71870 Overview
CVE-2026-71870 is a resource exhaustion vulnerability in pypdf, a pure-Python PDF library. Versions prior to 6.15.0 mishandle unusually large source-code or destination-string tokens when parsing font /ToUnicode CMap entries during text extraction. A crafted PDF can trigger large memory consumption inside the parse_bfrange function in pypdf/_cmap.py. The issue is tracked as [CWE-400: Uncontrolled Resource Consumption]. Maintainers fixed the flaw in pypdf 6.15.0.
Critical Impact
Applications that extract text from untrusted PDFs using vulnerable pypdf versions can exhaust host memory, degrading availability of the calling service.
Affected Products
- pypdf versions prior to 6.15.0
- Python applications importing pypdf for PDF text extraction
- Downstream tooling that wraps pypdf for document processing pipelines
Discovery Timeline
- 2026-08-07 - CVE-2026-71870 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-71870
Vulnerability Analysis
The flaw resides in pypdf/_cmap.py, specifically the parse_bfrange function. This routine processes bfrange entries within a font's /ToUnicode CMap, which map character codes to Unicode values during text extraction. When the parser encounters unusually large source-code ranges or destination-string tokens, it allocates memory proportional to the declared range without bounding the input. A crafted PDF supplies oversized values that force pypdf to allocate excessive memory during a single extraction call. See the GitHub Security Advisory GHSA-fp3f-mc75-235c for details.
Root Cause
The root cause is missing bounds validation on attacker-controlled length and range fields inside CMap bfrange structures. The parser trusts declared values from the PDF and expands them into in-memory mapping tables. No cap constrains the resulting allocations, so a small malicious file produces a large working set.
Attack Vector
Exploitation requires an application to call pypdf text-extraction APIs against an attacker-supplied PDF. The attack vector is local per the CVSS 4.0 vector, and user interaction is passive: a user or automated job opens or processes the file. Successful exploitation causes memory exhaustion and denial of service in the host process. There is no confidentiality or integrity impact.
No verified proof-of-concept code has been published. Technical details are described in prose only, per the pypdf 6.15.0 release notes and pull request #3944.
Detection Methods for CVE-2026-71870
Indicators of Compromise
- Python processes importing pypdf that show sudden, sustained memory growth while parsing a single PDF
- Out-of-memory (OOM) kills or container restarts correlated with PDF ingestion jobs
- Stack traces terminating inside pypdf/_cmap.py at parse_bfrange
Detection Strategies
- Inventory Python environments and identify installed pypdf versions using pip show pypdf or SBOM tooling
- Instrument document-processing services with per-request memory limits and log allocations exceeding a defined threshold
- Correlate PDF ingestion events with process resource metrics to flag anomalous extraction jobs
Monitoring Recommendations
- Track container and worker memory usage during PDF text extraction and alert on outliers
- Capture the file hashes of PDFs that trigger OOM conditions for retrospective analysis
- Forward Python application logs into a central data lake to correlate crashes with input files
How to Mitigate CVE-2026-71870
Immediate Actions Required
- Upgrade pypdf to version 6.15.0 or later in all environments processing untrusted PDFs
- Audit CI/CD pipelines, serverless functions, and container images for pinned vulnerable versions
- Restart long-running services after upgrade to ensure the patched library is loaded
Patch Information
The fix is included in pypdf 6.15.0 and delivered by commit afba8080 via pull request #3944. Install the patched release with pip install --upgrade pypdf>=6.15.0. Verify installation with pip show pypdf and confirm the reported version is 6.15.0 or newer.
Workarounds
- Run PDF extraction workers inside sandboxes with strict memory cgroup limits to contain exhaustion
- Reject or quarantine PDFs from untrusted sources until the upgrade is deployed
- Disable text extraction paths that invoke CMap parsing where the feature is not required
# Configuration example
pip install --upgrade "pypdf>=6.15.0"
pip show pypdf | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
