CVE-2026-27025

Katalog CVE

CVSS 5.5 · Medium EPSS 0,19%

Kerentanan Excessive Iteration pada pypdf project pypdf. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.

Rincian

Terbit di NVD

20 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-834: Excessive Iteration

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wgvp-vg3v-2xq3 patch · advisory vendor
• https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2 patch
• https://github.com/py-pdf/pypdf/pull/3646 issue tracking · patch
• https://github.com/py-pdf/pypdf/releases/tag/6.7.1 product · release notes