pypdf: Uncontrolled resource consumption during form flattening
Summary
pypdf, a pure-Python PDF library, can take excessive time to generate appearance streams when an application updates form fields with flattening enabled. A crafted PDF with form field values triggers repeated, unnecessary work inside a loop in the appearance stream code. An attacker who can get such a file processed can cause long runtimes and make the application unavailable (denial of service). The issue requires an application that processes untrusted PDFs with form flattening; having pypdf installed alone is not sufficient.
Affected
- pypdf versions before 6.19.0
Fixed in
- Upgrade to pypdf 6.19.0 or later (fix in commit 959467a9 / PR #4087)
Workaround
- No official workaround is published; the upstream advisory suggests applying the changes from PR #4087 if an upgrade is not possible.
- Operational mitigation: set time limits for form-filling jobs, run PDF processing in a separate worker with resource limits, and do not flatten forms from untrusted uploads.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS score is low.
Our recommendation
- Check whether pypdf is used directly or as a dependency of other tools (requirements files, lock files, container images).
- Upgrade to pypdf 6.19.0 or later, including distro-packaged copies that may lag behind.
- Until patched, prioritise internet-facing applications that accept PDFs and use form flattening, and apply time limits and resource limits.
- Monitor job runtimes and worker availability for anomalies.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-php9-fj8v-98fj github.com
- pypdf 6.19.0 release github.com
- Fix commit 959467a9 github.com
- Pull request #4087 github.com
- OSV/GitHub advisory mirror (GitLab) advisories.gitlab.com
- Ubuntu security tracker ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:25.
Original description (NVD)
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.