pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. This issue has been fixed in 6.0.0. If an update is not possible, a workaround involves including the fixed code from pypdf.filters.decompress into the existing filters file.
References
| Link | Resource |
|---|---|
| https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143 | Product |
| https://github.com/py-pdf/pypdf/issues/3429 | Issue Tracking |
| https://github.com/py-pdf/pypdf/pull/3430 | Patch |
| https://github.com/py-pdf/pypdf/releases/tag/6.0.0 | Release Notes |
| https://github.com/py-pdf/pypdf/security/advisories/GHSA-7hfw-26vp-jp8m | Third Party Advisory Mitigation |
Configurations
History
15 Aug 2025, 20:05
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Pypdf Project
Pypdf Project pypdf |
|
| References | () https://github.com/py-pdf/pypdf/releases/tag/6.0.0 - Release Notes | |
| References | () https://github.com/py-pdf/pypdf/issues/3429 - Issue Tracking | |
| References | () https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143 - Product | |
| References | () https://github.com/py-pdf/pypdf/security/advisories/GHSA-7hfw-26vp-jp8m - Third Party Advisory, Mitigation | |
| References | () https://github.com/py-pdf/pypdf/pull/3430 - Patch |
13 Aug 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-13 23:15
Updated : 2025-08-15 20:05
NVD link : CVE-2025-55197
Mitre link : CVE-2025-55197
JSON object : View
Products Affected
pypdf_project
- pypdf