CVE-2026-41312 — Memory Allocation with Excessive Size Value in Pypdf

CWE-789 — Memory Allocation with Excessive Size Value CWE-770 — Allocation of Resources Without Limits or Throttling3 documents3 sources

Severity

4.8MEDIUMNVD

EPSS

0.0%

top 93.67%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Py-pdf Pypdf Ansible-automation-platform-25 Lightspeed-chatbot-rhel8 Lightspeed-core Rag-tool-rhel9 +8 more

Timeline

PublishedApr 22

Description

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages11 packages

▶CVEListV5py-pdf/pypdf< 6.10.2

▶Red Hatopenshift-lightspeed/lightspeed-ocp-rag-rhel9

▶Red Hatopenshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9

▶Red Hatquay/quay-rhel8

▶Red Hatquay/quay-rhel9

📋Vendor Advisories

Red Hat

pypdf: pypdf: Denial of Service due to excessive memory consumption via specially crafted PDF↗2026-04-22

▶

💬Community

Bugzilla

CVE-2026-41312 pypdf: pypdf: Denial of Service due to excessive memory consumption via specially crafted PDF↗2026-04-22

▶