AIKIDO-2026-88888
pypdf is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
pypdfTL;DR
During text extraction, pypdf follows the Do operator into form XObjects via _extract_text__xform() without limiting how many times those forms are expanded. A crafted page with many form XObjects, including reused ones, can cause excessive traversal, long runtimes, and large memory use. The fix tracks invocations with _TraversalState and skips further form content after MAX_XFORM_INVOCATIONS_PER_EXTRACTION (5,000) is reached, and skips cyclic form references.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application extracts text from untrusted PDF files that contain form XObjects.
Background info
pypdf is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 6.16.0.
How to fix this
Upgrade the pypdf library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant