EUVD-2026-32912
GHSA-wjqc-6w8f-h24c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5Blast Radius
ecosystem impact- 1 pypi packages depend on pypdf (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 6.12.1.
DescriptionGitHub Advisory
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.
AnalysisAI
Memory exhaustion in pypdf's XMP metadata parser allows denial of service via specially crafted PDF files containing oversized or element-dense XMP blocks, affecting all versions prior to 6.12.1. The vulnerability stems from an absence of input limits in the XML-based XMP parsing subsystem (CWE-770), meaning processing a malicious PDF can consume unbounded system memory. No public exploit code has been identified at time of analysis, and no confirmed active exploitation exists; however, the patch diff is publicly visible on GitHub, making trivial exploit construction feasible.
Technical ContextAI
pypdf is a widely-used pure-Python PDF library (CPE: cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*) that implements XMP (Extensible Metadata Platform) metadata parsing via a custom XML parser class (_XmpBuilder) derived from Python's ExpatBuilderNS in pypdf/xmp.py. Prior to 6.12.1, this parser imposed no constraints on either the byte length of the XMP data stream or the count of XML elements processed during parsing - a textbook instance of CWE-770 (Allocation of Resources Without Limits or Throttling). An attacker embedding a multi-megabyte XMP block or crafting one with hundreds of thousands of XML elements causes the Python process to allocate memory proportional to the input size with no ceiling. The fix introduces two tunable constants: XMP_MAX_INPUT_LENGTH (defaulting to 5,000,000 bytes) and XMP_MAX_ELEMENT_COUNT (defaulting to 100,000), enforced by raising a LimitReachedError early in parsing. The element limit is enforced via a custom start_element_handler hook on the Expat parser, and the stream length check gates parsing before any XML processing begins.
RemediationAI
Upgrade pypdf to version 6.12.1 or later, the confirmed vendor-released patch available at https://github.com/py-pdf/pypdf/releases/tag/6.12.1. Version 6.12.1 introduces configurable hard limits of 5 MB on XMP stream size (XMP_MAX_INPUT_LENGTH) and 100,000 on XML element count (XMP_MAX_ELEMENT_COUNT); these constants are exposed as module-level attributes in pypdf.xmp and can be tuned downward if stricter limits are warranted. If an immediate upgrade is blocked, a compensating control is to enforce a file size or metadata size ceiling in the application layer before invoking pypdf - for example, rejecting PDFs whose raw file size exceeds a defined threshold, or stripping XMP metadata using a separate tool prior to parsing. Note that stripping XMP data may affect downstream metadata-dependent workflows. Another option is to wrap pypdf XMP parsing calls in a subprocess with memory limits enforced by the OS (e.g., ulimit -v on Linux), which bounds the blast radius to the subprocess rather than the main application - at the cost of added latency and complexity.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today