ZeroDay Findings
Sign inSign up

Findings

CVE-2026-28804

pypdf is a free and open-source pure-python PDF library.

Published Mar 6, 2026 · updated Jun 17, 2026 · pypdf project pypdf

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 6, 2026 · NIST NVD

    Detected

    pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.

  2. Jun 17, 2026 · NIST NVD

    Updated

    pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.

Affected

  • cpe pypdf project/pypdfversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-28804

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-28804

    pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.

    nvd.nist.gov

References