Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-102997

pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

py-pdf pypdf

  • < 6.18.1affected

References