6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31826

CVE-2026-31826: pypdf: manipulated stream length values can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31826

CVE-2026-31826:

6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.8.0	6.8.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the pypdf library's handling of stream objects within a PDF file. Specifically, the DictionaryObject.read_from_stream function in pypdf/generic/_data_structures.py was identified as the vulnerable function. The analysis of the patch commit 3c550b3196adeba1506a26e57c09c09fac75e9aa reveals that the vulnerability is caused by unconditionally trusting the /Length attribute of a stream object. An attacker can craft a PDF with a manipulated, very large /Length value. When pypdf processes this stream, the read_from_stream function would attempt to read the specified number of bytes into memory via stream.read(length). This leads to excessive memory allocation, which can exhaust system resources and cause a denial of service. The patch mitigates this by introducing a size validation check. It compares the stream's declared length against a new constant, MAX_DECLARED_STREAM_LENGTH, and raises a LimitReachedError if the length is excessive, preventing the large memory allocation. Therefore, any runtime profile during the exploitation of this vulnerability would show DictionaryObject.read_from_stream as a key function in the stack trace leading to the memory allocation.

Vulnerable functions

DictionaryObject.read_from_stream

pypdf/generic/_data_structures.py

The function `read_from_stream` is responsible for reading stream data from a PDF. It reads the stream's declared length from the PDF metadata. Before the patch, it would use this length directly in a `stream.read(length)` call. A malicious PDF could provide an extremely large length value, causing the application to attempt to allocate a massive amount of memory, leading to a denial-of-service (DoS) attack through RAM exhaustion. The patch adds a check to ensure the declared length does not exceed a predefined maximum before attempting to read the data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.