CVE-2026-71852: Denial of Service via Excessive Iteration and Memory Exhaustion in pypdf CID Font Parsing
Vulnerability ID: CVE-2026-71852
CVSS Score: 4.8
Published: 2026-08-07
A Denial of Service (DoS) vulnerability exists in pypdf prior to version 6.15.0. When parsing maliciously crafted PDF files containing excessively large CID font width ranges, the library suffers from CPU starvation and memory exhaustion due to unconstrained loop expansion.
TL;DR
Unconstrained CID font width expansion in pypdf leads to application hang and OOM crashes.
Technical Details
- CWE ID: CWE-834
- Attack Vector: Local
- CVSS v4.0: 4.8
- Impact: Denial of Service (DoS)
- Exploit Status: none
- KEV Status: Not Listed
Affected Systems
- Any Python application or backend service utilizing pypdf versions prior to 6.15.0 to extract text, parse metadata, or merge PDF documents.
-
pypdf: < 6.15.0 (Fixed in:
6.15.0)
Code Analysis
Commit: 51cb6ac
Fix Denial of Service in CID font parsing by validating range limits
Mitigation Strategies
- Upgrade pypdf to 6.15.0 or later.
- Implement process memory constraints via Docker or cgroups.
- Apply input-size limits on uploaded PDF files.
Remediation Steps:
- Identify all environments using pypdf.
- Execute 'pip install --upgrade pypdf>=6.15.0'.
- Verify that parsing tasks do not fail on legitimate PDFs.
- Apply application-level timeouts and sandbox boundaries for document processing workers.
References
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42
- https://github.com/py-pdf/pypdf/pull/3946
- https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7
- https://github.com/py-pdf/pypdf/releases/tag/6.15.0
- https://www.cve.org/CVERecord?id=CVE-2026-71852
Read the full report for CVE-2026-71852 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)