MEDIUM Published March 6, 2026

CVE-2026-28804

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.

CVSS base score

5.3 (v3.1)

Severity

MEDIUM

Attack vector

Network

Weakness

CWE-407

Last modified

November 2, 2026

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

py-pdf pypdf

References

github.com Patch
github.com Issue Tracking, Patch
github.com Product, Release Notes
github.com Patch, Vendor Advisory

View full NVD advisory →

More py-pdf vulnerabilities

Published the same day

← Back to CVE watch

CVE-2026-28804

Affected products

References

More py-pdf vulnerabilities

Published the same day

Related reading