PyPI/pypdf CVE-2025-66019: medium 6.6, EPSS 0.39%

pypdf's LZWDecode streams be manipulated to exhaust RAM

Action: Upgrade pypdf to 6.4.0 or later.

pip install pypdf==6.4.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1832
• nvd: CVE-2025-66019
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j
• https://github.com/py-pdf/pypdf/security/advisories/GHSA-m449-cwjh-6pw7
• https://github.com/py-pdf/pypdf/commit/96186725e5e6f237129a58a97cd19204a9ce40b2
• https://aydinnyunus.github.io/2025/12/20/cve-2025-66019-pypdf-lzw-dos
• https://github.com/py-pdf/pypdf
• https://github.com/py-pdf/pypdf/releases/tag/6.4.0
• https://pypi.org/project/pypdf
• https://github.com/advisories/GHSA-m449-cwjh-6pw7

CVE-2025-66019 · published 2026-07-07T16:03:10.809096Z · modified 2026-07-07T17:46:59.109908172Z · JSON