pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.
References
| Link | Resource |
|---|---|
| https://github.com/py-pdf/pypdf/commit/d9d38cf99b115deb562d3b68f36c33027bc04f79 | Patch |
| https://github.com/py-pdf/pypdf/pull/4073 | Patch Issue Tracking |
| https://github.com/py-pdf/pypdf/releases/tag/6.18.1 | Release Notes |
| https://github.com/py-pdf/pypdf/security/advisories/GHSA-jw7q-gvrg-4vj3 | Vendor Advisory |
Configurations
History
05 Oct 2026, 15:07
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* | |
| First Time |
Pypdf Project
Pypdf Project pypdf |
|
| References | () https://github.com/py-pdf/pypdf/commit/d9d38cf99b115deb562d3b68f36c33027bc04f79 - Patch | |
| References | () https://github.com/py-pdf/pypdf/pull/4073 - Patch, Issue Tracking | |
| References | () https://github.com/py-pdf/pypdf/releases/tag/6.18.1 - Release Notes | |
| References | () https://github.com/py-pdf/pypdf/security/advisories/GHSA-jw7q-gvrg-4vj3 - Vendor Advisory |
30 Sep 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-30 21:17
Updated : 2026-10-05 15:07
NVD link : CVE-2026-102997
Mitre link : CVE-2026-102997
CVE.ORG link : CVE-2026-102997
JSON object : View
Products Affected
pypdf_project
- pypdf