Disclosure summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.
Source-reported weakness categories
CWE-400, CWE-407
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-102997
Open original source · Updated Oct 05, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| pypdf_project | pypdf | * {"versionEndExcluding":"6.18.1"} |
GitHub Reviewed Security Advisories · GHSA-jw7q-gvrg-4vj3
Open original source · Updated Oct 01, 2026
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
Source severity: HIGH / 8.7
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | pypdf | < 6.18.1 | 6.18.1 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Patch, Issue Tracking
- github.com — Release Notes
- github.com — Vendor Advisory
PUBLISHED 2026-09-30T17:17:07-04:00
MODIFIED 2026-10-05T11:07:04-04:00
INGESTED 2026-10-06T11:44:59-04:00