CVE-2026-49460 · Symaro Security Advisory

Description

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.

Severity (CVSS)

Base score	5.1
Severity	Medium
Version	CVSS 4.0
Vector	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-407 — CWE-407: Inefficient Algorithmic Complexity

Affected products

Vendor	Product	Versions
py-pdf	pypdf	< 6.12.2

References

https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg (x_refsource_CONFIRM)
https://github.com/py-pdf/pypdf/pull/3806 (x_refsource_MISC)
https://github.com/py-pdf/pypdf/releases/tag/6.12.2 (x_refsource_MISC)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 23 Jun 2026 10:05 UTC.