pypdf: Missing stream length values ignore defined limits

中 6.5CVE-2026-57204 · GHSA-jm82-fx9c-mx94 · 30/06/2026 公開 · 25/10/2026 更新

要点

CVE-2026-57204 は pypdf, pypdf (pypdf project) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.37%（全脆弱性の 30.6% より高い）。
対処：6.13.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
pypdf PyPI	`< 6.13.3`	`6.13.3`
pypdf pypdf_project	`< 6.13.3`	`6.13.3`

概要

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value.

Patches

This has been fixed in pypdf==6.13.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #3871.

NVD の説明

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value. This issue has been fixed in version 6.13.3.