mediumVulnerability
GHSA-jm82-fx9c-mx94
### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value. ### Patches This has been fixed in [pypdf==6.13.3](https://github.com/py-pdf/pypdf/releases/tag/6.13.3). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3871](https://github.com/py-pdf/pypdf/pull/3871).
Properties
- ghsa_id
- GHSA-jm82-fx9c-mx94
- severity
- medium
- summary
- pypdf: Missing stream length values ignore defined limits
- cve_id
- GHSA-jm82-fx9c-mx94
- is_ghsa_only
- true
- ghsa_published
- 2026-06-18T14:28:49Z
- source_url
- https://github.com/advisories/GHSA-jm82-fx9c-mx94
- ghsa_updated
- 2026-06-18T14:28:51Z
Related Entities (5)
HAS_WEAKNESS (2)
→[Weakness]Uncontrolled Resource Consumption
→[Weakness]Allocation of Resources Without Limits or Throttling
REPORTED_BY (1)
→[Source]GitHub Advisory Database
VULNERABLE_TO (1)
←[Software]pip/pypdf
AFFECTS (1)
→[Software]pip/pypdf
Explore deeper with Ninja Signal's threat intelligence graph