CVE-2026-28804

pypdf: Inefficient decoding of ASCIIHexDecode streams

Description

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.

Scores

Weaknesses (CWE)

• CWE-407

Advisories

• GHSA-9m86-7pmv-2852 — pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams
• PYSEC-2026-3014 — pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams

European references

• ENISA EUVD · EUVD-2026-10010
• GCVE · GCVE-0-2026-28804

CERT-FR advisories

• CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0550 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* < 6.7.5

Affected products

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852
• https://github.com/py-pdf/pypdf/pull/3666
• https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f
• https://github.com/py-pdf/pypdf/releases/tag/6.7.5

Sources