Fluid Attacks Database

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	pypdf	=3.17.4-1 \|\| =3.4.1-1 \|\| =3.4.1-1+deb12u1 \|\| =4.0.0-1 \|\| =4.0.0-1~exp1 \|\| =4.0.1-1 \|\| =4.0.2-1 \|\| =4.1.0-1 \|\| =4.2.0-1 \|\| =4.3.1-1 \|\| =5.4.0-1 \|\| =6.9.0-1 \|\| =6.9.2-1 \|\| =6.9.2-2	-
debian 14	pypdf	=5.4.0-1 \|\| =6.9.0-1 \|\| =6.9.2-1 \|\| =6.9.2-2	-
debian 12	pypdf2	=2.12.1-3 \|\| =2.12.1-3+deb12u1 \|\| =2.12.1-4	-
debian 13	pypdf	=5.4.0-1 \|\| =6.9.0-1 \|\| =6.9.2-1 \|\| =6.9.2-2	-
pypi	pypdf	>=0 <6.12.2	6.12.2

Aliases

1. CVE-2026-494602. NVD-2026-494603. OSV-DEBIAN-2026-494604. OSV-2026-494605. GHSA-5hgr-hg42-57jg6. GCVE-2026-494607. SECURITY-TRACKER-CVE-2026-49460

References

1. https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg2. https://github.com/py-pdf/pypdf/pull/38063. https://github.com/py-pdf/pypdf/releases/tag/6.12.2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.