CVE-2026-57204— pypdf: Missing stream length values ignore defined limits
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57204
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
pypdf: Missing stream length values ignore defined limits
Source: NVD (National Vulnerability Database)
Vulnerability Description
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value. This issue has been fixed in version 6.13.3.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: NVD (National Vulnerability Database)
Vulnerability Title
py-pdf pypdf 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
py-pdf pypdf是py-pdf组织开源的一个免费开源的纯 python PDF 库。能够拆分、合并、裁剪和转换 PDF 文件的页面。 py-pdf pypdf 6.13.3之前版本存在资源管理错误漏洞，该漏洞源于解析无/Length值的内容流时忽略MAX_DECLARED_STREAM_LENGTH，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-57204
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57204
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-57204 (1)
- 🔗 Release Version 6.13.3, 2026-06-17 · py-pdf/pypdf · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-57204 (1)
IV. Related Vulnerabilities
Same product: pypdf
- CVE-2026-54651
pypdf: Possible infinite loop when processing threads/articl - CVE-2026-49460
pypdf: Inefficient decoding of FlateDecode PNG predictor str - CVE-2026-49461
pypdf: Possible large memory usage for form XObjects during - CVE-2026-54531
pypdf: Possible infinite loop when processing outlines/bookm - CVE-2026-54530
pypdf: Possible infinite loop when retrieving fonts for layo
Same vendor: py-pdf
- CVE-2026-54651
pypdf: Possible infinite loop when processing threads/articl - CVE-2026-49460
pypdf: Inefficient decoding of FlateDecode PNG predictor str - CVE-2026-49461
pypdf: Possible large memory usage for form XObjects during - CVE-2026-54531
pypdf: Possible infinite loop when processing outlines/bookm - CVE-2026-54530
pypdf: Possible infinite loop when retrieving fonts for layo
Same weakness: CWE-400
- CVE-2026-26307
Gitea git grep search lacks a timeout - CVE-2026-9563
Eclipse Foundation Eclipse Parsson 资源管理错误漏洞 - CVE-2026-54712
OpenTelemetry Javaagent RMI context propagation allows resou - CVE-2026-54260
Wagtail: Denial of service via unbounded filter specs in the - CVE-2026-55595
ImageMagick: Infinite Loop in connected-components when prov
V. Comments for CVE-2026-57204
No comments yet