CVE-2026-28804

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-28804
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f Patch
https://github.com/py-pdf/pypdf/pull/3666 Issue Tracking Patch
https://github.com/py-pdf/pypdf/releases/tag/6.7.5 Product Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*
History

10 Mar 2026, 19:39

Type Values Removed Values Added
References () https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f - () https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f - Patch
References () https://github.com/py-pdf/pypdf/pull/3666 - () https://github.com/py-pdf/pypdf/pull/3666 - Issue Tracking, Patch
References () https://github.com/py-pdf/pypdf/releases/tag/6.7.5 - () https://github.com/py-pdf/pypdf/releases/tag/6.7.5 - Product, Release Notes
References () https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852 - () https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852 - Patch, Vendor Advisory
First Time Pypdf Project
Pypdf Project pypdf
Summary
  • (es) pypdf es una librería PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.7.5, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca tiempos de ejecución prolongados. Esto requiere acceder a un flujo que utiliza el filtro /ASCIIHexDecode. Este problema ha sido parcheado en la versión 6.7.5.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CPE cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*

06 Mar 2026, 07:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-06 07:16

Updated : 2026-03-10 19:39

NVD link : CVE-2026-28804

Mitre link : CVE-2026-28804

CVE.ORG link : CVE-2026-28804

JSON object : View

Products Affected

pypdf_project

  • pypdf
CWE
CWE-407

Inefficient Algorithmic Complexity