Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-28804: pypdf PDFs Can Cause Slow Performance
CVE-2026-28804 · published 8 months ago
Summary
A security issue in older versions of the pypdf library allows attackers to create a PDF that causes it to run slowly. This could impact performance, but not access sensitive data. Update to version 6.7.5 or later to fix the issue.
What to do
- Update stefan6419846 pypdf to version 6.7.5.
- Update debian pypdf to version 6.9.0-1.
- Update stefan6419846 pypdf to version 6.6.0+aikido.9.
- Update rootio-pypdf to version 6.6.0+root.io.9.
- Update rootio-pypdf to version 6.6.0+root.io.5.
- Update rootio-pypdf to version 6.6.0+root.io.10.
- Update stefan6419846 pypdf to version 6.6.0+aikido.13.
- Update rootio-pypdf to version 6.6.0+root.io.11.
- Update stefan6419846 pypdf to version 6.6.0+aikido.15.
- Update pypdf_project pypdf to version 6.7.5 or later.
- Update py-pdf pypdf to version 6.7.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | stefan6419846 | pypdf |
< 6.7.5 Fix: upgrade to 6.7.5
|
| Debian:12 | debian | pypdf | All versions |
| Debian:13 | debian | pypdf | All versions |
| Debian:14 | debian | pypdf |
< 6.9.0-1 Fix: upgrade to 6.9.0-1
|
| Debian:11 | debian | pypdf2 | All versions |
| Debian:12 | debian | pypdf2 | All versions |
| – | pypdf_project | pypdf |
< 6.7.5 cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* |
| Root:PyPI | stefan6419846 | pypdf |
< 6.6.0+aikido.9 < 6.6.0+aikido.13 < 6.6.0+aikido.15 Fix: upgrade to 6.6.0+aikido.9
|
| Root:PyPI | – | rootio-pypdf |
< 6.6.0+root.io.9 < 6.6.0+root.io.5 < 6.6.0+root.io.10 < 6.6.0+root.io.11 Fix: upgrade to 6.6.0+root.io.9
|
| – | py-pdf | pypdf |
< 6.7.5 cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:* |
| Ubuntu:24.04:LTS | canonical | pypdf | All versions |
Original advisory text
pypdf: Inefficient decoding of ASCIIHexDecode streams
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.
References
- https://security-tracker.debian.org/tracker/CVE-2026-28804 Vendor Advisory
- https://github.com/advisories/GHSA-9m86-7pmv-2852
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28804... Vendor Advisory
- https://github.com/py-pdf/pypdf Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-28804 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-28804 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-28804 Third Party Advisory
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852 Vendor Advisory
- https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f Patch
- https://github.com/py-pdf/pypdf/pull/3666 Patch
- https://github.com/py-pdf/pypdf/releases/tag/6.7.5 URL
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-407Inefficient Algorithmic Complexity
Timeline
Published6 Mar 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
DEBIAN-CVE-2026-28804 · OSV
CVE-2026-28804 · NVD
GHSA-9m86-7pmv-2852 · GHSA
GHSA-9m86-7pmv-2852 · OSV
CVE-2026-28804 · OSV
UBUNTU-CVE-2026-28804 · OSV
Track software like this
Free during beta