Skip to content

Possible long runtimes/large memory usage when extracting XForm objects

Moderate
stefan6419846 published GHSA-763m-79hh-57f2 Aug 14, 2026

Package

pip pypdf (pip)

Affected versions

< 6.16.1

Patched versions

>= 6.16.1

Description

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.

Patches

This has been fixed in pypdf==6.16.1.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3966.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Excessive Iteration

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. Learn more on MITRE.

Credits