5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33123

CVE-2026-33123: pypdf has inefficient decoding of array-based streams

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33123

CVE-2026-33123:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypdf	pip	< 6.9.1	6.9.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the ContentStream.__init__ method in pypdf/generic/_data_structures.py. The original implementation handled array-based content streams by repeatedly concatenating byte strings using the += operator. This operation is inefficient in Python as it creates a new byte string object with each concatenation, leading to a quadratic time complexity (O(n^2)) where n is the number of streams. An attacker could craft a PDF with a content stream composed of a large array of smaller streams, causing the application to consume excessive CPU and memory, resulting in a denial of service. The patch addresses this by replacing the inefficient string concatenation with a bytearray and also introduces size and length limits (MAX_ARRAY_BASED_STREAM_OUTPUT_LENGTH and CONTENT_STREAM_ARRAY_MAX_LENGTH) to prevent resource exhaustion. The vulnerable function is clearly ContentStream.__init__ as it's where the inefficient processing occurs.

Vulnerable functions

ContentStream.__init__

pypdf/generic/_data_structures.py

The `__init__` method of the `ContentStream` class was vulnerable to inefficient decoding of array-based streams. When a `ContentStream` was initialized with an `ArrayObject`, the code would iterate through each stream in the array and concatenate its data. The use of `+=` on bytes objects (`data += s_resolved.get_data()`) is inefficient and has quadratic complexity, leading to excessive CPU and memory consumption when processing a crafted PDF with a large number of streams in the array. The patch mitigates this by using a more efficient `bytearray` for concatenation and by adding limits to the number of streams and the total output size.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.