github.com
https://github.com/py-pdf/pypdf GHSA-JM82-FX9C-MX94
pypdf: Missing stream length values ignore defined limits
Description
### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value. ### Patches This has been fixed in [pypdf==6.13.3](https://github.com/py-pdf/pypdf/releases/tag/6.13.3). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3871](https://github.com/py-pdf/pypdf/pull/3871).
Description source: GitHub Advisory
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
pypdfBrowse PyPI / pypdf | GitHub Advisory | Before 6.13.3 · Fixed in 6.13.3 | affected |
References
4github.com
https://github.com/py-pdf/pypdf/pull/3871 github.com
https://github.com/py-pdf/pypdf/releases/tag/6.13.3 github.com
https://github.com/py-pdf/pypdf/security/advisories/GHSA-jm82-fx9c-mx94