pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.
PUBLISHED5.2CWE-407
pypdf: Inefficient decoding of FlateDecode PNG predictor streams
Problem type
Affected products
py-pdf
pypdf
< 6.12.2 - AFFECTED
References
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg
https://github.com/py-pdf/pypdf/pull/3806
https://github.com/py-pdf/pypdf/pull/3806
https://github.com/py-pdf/pypdf/releases/tag/6.12.2
https://github.com/py-pdf/pypdf/releases/tag/6.12.2
GitHub Security Advisories
GHSA-5hgr-hg42-57jg
pypdf: Inefficient decoding of FlateDecode PNG predictor streams
https://github.com/advisories/GHSA-5hgr-hg42-57jgImpact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor.
Patches
This has been fixed in pypdf==6.12.2.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3806.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-49460Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-49460",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-06-22T20:28:16.413Z",
"dateReserved": "2026-05-30T02:43:33.107Z",
"datePublished": "2026-06-22T20:28:16.413Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-06-22T20:28:16.413Z"
},
"title": "pypdf: Inefficient decoding of FlateDecode PNG predictor streams",
"descriptions": [
{
"lang": "en",
"value": "pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2."
}
],
"affected": [
{
"vendor": "py-pdf",
"product": "pypdf",
"versions": [
{
"version": "< 6.12.2",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"cweId": "CWE-407",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg",
"name": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/py-pdf/pypdf/pull/3806",
"name": "https://github.com/py-pdf/pypdf/pull/3806",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/py-pdf/pypdf/releases/tag/6.12.2",
"name": "https://github.com/py-pdf/pypdf/releases/tag/6.12.2",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{}
]
}
}
}