PyPI/pypdf CVE-2026-31826: medium 5.5, EPSS 0.18%

pypdf: manipulated stream length values can exhaust RAM

Action: Upgrade pypdf to 6.8.0 or later.

pip install pypdf==6.8.0

Affected

Fixed versions

Sources

• osv: GHSA-hqmh-ppp3-xvm7
• nvd: CVE-2026-31826
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7
• https://github.com/py-pdf/pypdf/pull/3675
• https://github.com/py-pdf/pypdf/commit/3c550b3196adeba1506a26e57c09c09fac75e9aa
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.8.0

CVE-2026-31826 · published 2026-03-11T00:14:02Z · modified 2026-09-10T03:50:39.503255117Z · JSON