6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28804

CVE-2026-28804: pypdf: Inefficient decoding of ASCIIHexDecode streams

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28804

CVE-2026-28804:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.7.5	6.7.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is an inefficient decoding of ASCIIHexDecode streams in pypdf. The provided information included a link to a pull request (PR #3666) that patches the vulnerability. By inspecting the commits within this pull request, specifically commit a7f4df49c0af8aac582101a5c466d82688a029ee, I was able to pinpoint the exact code change that addresses the issue. The commit modifies the decode function within the ASCIIHexDecode class in the pypdf/filters.py file. The original, vulnerable code iterated through the data byte-by-byte, which is inefficient. The patch replaces this with a much more performant implementation that uses the built-in binascii.unhexlify function. Therefore, the ASCIIHexDecode.decode function is the vulnerable function.

Vulnerable functions

ASCIIHexDecode.decode

pypdf/filters.py

The vulnerability lies in the `decode` method of the `ASCIIHexDecode` class. The original implementation processed the input stream character by character within a `while` loop. This approach is highly inefficient and performs poorly on large inputs, leading to excessive CPU consumption and a denial of service. An attacker could craft a PDF with a large stream encoded with `/ASCIIHexDecode` to trigger this inefficient decoding process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.