DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-71870: CVE-2026-71870: Uncontrolled Resource Consumption (DoS) in pypdf ToUnicode CMap Parsing

#security #cve #cybersecurity

CVE-2026-71870: Uncontrolled Resource Consumption (DoS) in pypdf ToUnicode CMap Parsing

Vulnerability ID: CVE-2026-71870
CVSS Score: 4.8
Published: 2026-08-07

An uncontrolled resource consumption vulnerability (CWE-400) exists in pypdf prior to version 6.15.0. When extracting text from a specially crafted PDF document, the parser fails to restrict token lengths within /ToUnicode CMap streams, causing unbounded memory allocation and process termination via Out-of-Memory (OOM) crashes.

TL;DR

A vulnerability in pypdf allows attackers to trigger a Denial of Service (OOM crash) via crafted /ToUnicode CMap streams containing massive hex-encoded tokens.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Local (via crafted document parsing)
  • CVSS Score: 4.8
  • Impact: Denial of Service (OOM Process Crash)
  • Exploit Status: Proof-of-Concept only
  • KEV Status: Not listed

Affected Systems

  • pypdf library deployments processing untrusted PDF documents
  • pypdf: < 6.15.0 (Fixed in: 6.15.0)

Code Analysis

Commit: afba808

Restrict token lengths in CMaps to prevent uncontrolled resource allocation during PDF ToUnicode parsing.

Exploit Details

  • GHSA-fp3f-mc75-235c: GHSA advisory describing proof of concept and mapping mechanics of oversized /ToUnicode strings.

Mitigation Strategies

  • Upgrade the pypdf dependency to version 6.15.0 or later to ensure validation of CMap token sizes
  • Isolate PDF processing workers in containerized environments with strict memory limits using cgroups
  • Validate incoming file sizes and strip excessive stream data prior to extraction processing

Remediation Steps:

  1. Identify all deployment environments running the pypdf library
  2. Run 'pip install --upgrade pypdf>=6.15.0' or update the project requirements.txt/poetry.lock file
  3. Verify text extraction processes handle 'LimitReachedError' exceptions gracefully to prevent unhandled service crashes
  4. Configure container resources with memory limits to prevent host-level OOM events

References

Read the full report for CVE-2026-71870 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)