MajorCritical vulnerability
CVE-2026-102997: pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
GitHub Advisories · officialPublished Oct 1, 2026Risk 37/100
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed `/FlateDecode` stream, where the byte-by-byte decompression is used. ### Patches This has been fixed in [pypdf==6.18.1](https://github.com/py-pdf/pypdf/releases/tag/6.18.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4073](https://github.com/py-pdf/pypdf/pull/4073).
Recommended action
Recommended action
Upgrade affected packages to a patched version: pypdf 6.18.1.
Technical details
- Vendor
- Not specified
- Product
- pypdf
- Exploitation
- none known
- Evidence
- official
Evidence and sources
This record is attributed to GitHub Advisories. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source