Description
A crafted PDF whose indirect object identifiers or generation numbers run on without whitespace made pypdf scan excessive input in read_until_whitespace, causing long runtimes and high memory use (CWE-400, CWE-407). An application that opens untrusted PDFs with pypdf could be made unavailable by a single file. Fixed in 6.18.0 (PR #4055).
CVSS Vector
Primary assessmentGitHub CNA · 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NAV: NetworkAC: LowAT: NonePR: NoneUI: NoneVC: NoneVI: NoneVA: HighSC: NoneSI: NoneSA: None
Disclosure Status
- Affected
- pypdf before 6.18.0
- Patch status
- Fixed in 6.18.0
- Vendor response
- Maintainers limited the length of indirect object tokens (PR #4055) and published GHSA-5jq2-8x83-x246
- Primary score source
- GitHub CNA
References
- CVE.org Record
- GitHub Security Advisory GHSA-5jq2-8x83-x246
- Fix: limit allowed length of indirect object tokens (PR #4055)
- Fix commit 82501d2
- pypdf 6.18.0 release
- NVD — National Vulnerability Database
- MITRE CVE Entry
Record Verification
CreditThe GitHub advisory GHSA-5jq2-8x83-x246 credits Sevban DÖNMEZ (jankesec) as reporter
PublishedThe CVE record was published on 2026-09-30
CheckedMetadata last checked against the CVE Services record on 2026-10-30
Disclosure Timeline
2026-09-07Fix merged — Maintainers merged the change that limits the length of indirect object tokens (PR #4055). Source ↗
2026-09-30Published — GitHub, as CNA, published the CVE record and advisory GHSA-5jq2-8x83-x246. Source ↗
2026-10-30Site verification — jankesec checked the CVE record, score, affected versions, and references.