AIKIDO-2026-10937
pypdf is vulnerable to Denial of Service (DoS)
65
Medium Risk
This Affects:
pypdfTL;DR
Layout-mode text extraction in _fixed_width_page.py builds output by inserting padding spaces and blank lines from character position offsets in page content streams. A crafted PDF with extreme Tm horizontal displacements or large vertical gaps can make extract_text(extraction_mode="layout") allocate very large whitespace strings. Before the fix, extraction could consume substantial memory building the returned text. The fix caps intra-line whitespace padding and blank-line insertion at fixed limits and logs a warning when truncating.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
pypdf is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 6.11.0.
How to fix this
Upgrade the pypdf library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant