Description
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| py-pdf | pypdf | < 1.27.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | pypdf2 | 1.27.9-1 | — |
| Debian 10 | pypdf2 | 1.26.0-2+deb10u2 | DLA-3497-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | pypdf2 | 1.26.0-4ubuntu0.22.04.2 | USN-6280-1 |
| Ubuntu 20.04 LTS | pypdf2 | 1.26.0-3ubuntu1.20.04.2 | USN-6280-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | pypdf2 | 1.26.0-2ubuntu0.1~esm2 | USN-6280-1 |
| Ubuntu Pro 16.04 LTS | pypdf2 | 1.25.1-1ubuntu0.1~esm2 | USN-6280-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pypdf2 | < 1.27.9 | 1.27.9 | GHSA-jrm6-h9cq-8gqw |
Advisories 2
- USN-6280-1 pypdf2 vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3497-1 pypdf2 - security update Debian Security (DSA / DLA) · Mar 9, 2026