CVE-2025-66019 — Uncontrolled Resource Consumption in Pypdf

CWE-400 — Uncontrolled Resource ConsumptionCWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)CWE-770 — Allocation of Resources Without Limits or Throttling6 documents5 sources
Severity
6.6MEDIUMNVD
EPSS
0.1%
top 81.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Py-pdf PypdfPypdf Project PypdfDebian Pypdf
Timeline
PublishedNov 26

Description

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patched in version 6.4.0.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages3 packages

▶CVEListV5py-pdf/pypdf< 6.4.0
▶PyPIpypdf_project/pypdf< 6.4.0
▶debiandebian/pypdf

🔴Vulnerability Details

3
OSV
CVE-2025-66019: pypdf is a free and open-source pure-python PDF library↗2025-11-26
▶
OSV
pypdf's LZWDecode streams be manipulated to exhaust RAM↗2025-11-24
▶
GHSA
pypdf's LZWDecode streams be manipulated to exhaust RAM↗2025-11-24
▶

📋Vendor Advisories

2
Red Hat
pypdf: pypdf manipulated LZWDecode streams can exhaust RAM↗2025-11-25
▶
Debian
CVE-2025-66019: pypdf - pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0,...↗2025
▶