N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55197

CVE-2025-55197: PyPDF's Manipulated FlateDecode streams can exhaust RAM

Impact

An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access.

Patches

This has been fixed in pypdf==6.0.0.

Workarounds

If you cannot upgrade yet, you might want to implement the workaround for pypdf.filters.decompress yourself: https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143

References

This issue has been reported in #3429 and fixed in #3430.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-55197

CVE-2025-55197:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.0.0	6.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an uncontrolled resource consumption (CWE-400) issue in the pypdf library, specifically a decompression bomb. The root cause lies in the pypdf.filters.decompress function, which, prior to the patch, used Python's zlib.decompress without any limit on the size of the decompressed data. An attacker could craft a PDF containing a highly compressed data stream (e.g., using the FlateDecode filter) that would expand to an extremely large size upon decompression, exhausting system memory and causing a denial of service.

The patch addresses this by introducing a new function, _decompress_with_limit, which wraps the zlib decompression logic and enforces a maximum output length (ZLIB_MAX_OUTPUT_LENGTH). The decompress function was modified to use this new limited decompression function.

The primary vulnerable function is pypdf.filters.decompress. The pypdf.filters.FlateDecode.decode function is also considered vulnerable as it is the direct caller of decompress for the vulnerable filter type. A key trigger for this vulnerability is the pypdf._reader.PdfReader._read_pdf15_xref_stream function, which is called when a PDF file is opened and is responsible for parsing potentially compressed cross-reference streams. An exploit would involve a specially crafted PDF that, when opened by an application using the vulnerable pypdf library, would cause one of these functions to be called on the malicious data, leading to the DoS condition.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-55197: PyPDF's Manipulated FlateDecode streams can exhaust RAM

Impact

Patches

Workarounds

References

CVE-2025-55197:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

N/A

N/A

Basic Information

Basic Information

CVE-2025-55197: PyPDF's Manipulated FlateDecode streams can exhaust RAM

Impact

Patches

Workarounds

References

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI