medium5.1
CVE-2026-33123
pypdf has inefficient decoding of array-based streams
Impact
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries. ### Patches This has been fixed in [pypdf==6.9.1](https://github.com/py-pdf/pypdf/releases/tag/6.9.1). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3686](https://github.com/py-pdf/pypdf/pull/3686).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pypdf | < 6.9.1 | 6.9.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pypdf Project | Pypdf | before 6.9.1 |