6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27026

CVE-2026-27026: pypdf possibly has long runtimes for malformed FlateDecode streams

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used.

Patches

This has been fixed in pypdf==6.7.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3644.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27026

CVE-2026-27026:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.7.1	6.7.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit 7905842d833f899f1d3228af7e7467ad80277016 clearly points to a vulnerability within the decompress function located in pypdf/filters.py. The vulnerability description mentions long runtimes for malformed FlateDecode streams, and the patch directly addresses this issue. The core of the problem lies in the error handling of the decompress function. When zlib.decompress fails, it enters a recovery mode that processes the input byte by byte. Without a limit, a malicious PDF with a large, malformed Flate stream could cause this loop to run for an extended period, consuming significant CPU resources and leading to a denial of service. The patch mitigates this by introducing a new constant, ZLIB_MAX_RECOVERY_INPUT_LENGTH, and adding a check within the recovery loop to ensure it does not run indefinitely. Any runtime profile of an exploitation attempt would show significant time spent in the decompress function.

Vulnerable functions

decompress

pypdf/filters.py

The vulnerability is in the `decompress` function, which is responsible for handling FlateDecode streams. When a malformed stream is encountered, the function falls back to a byte-by-byte decompression method. This process can be extremely slow for large, crafted inputs, leading to a denial of service. The patch introduces `ZLIB_MAX_RECOVERY_INPUT_LENGTH` to limit the number of bytes processed during this recovery phase, thus preventing excessive runtimes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.