CVE-2025-55197

HighCVSS 7.5/10Last modified Nov 2, 2026

Description

pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. This issue has been fixed in 6.0.0. If an update is not possible, a workaround involves including the fixed code from pypdf.filters.decompress into the existing filters file.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
py-pdf	pypdf	< 6.0.0

References

https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143Product
https://github.com/py-pdf/pypdf/issues/3429Issue Tracking
https://github.com/py-pdf/pypdf/pull/3430Patch
https://github.com/py-pdf/pypdf/releases/tag/6.0.0Release Notes
https://github.com/py-pdf/pypdf/security/advisories/GHSA-7hfw-26vp-jp8mMitigation, Third Party Advisory

Timeline

Published: Aug 13, 2025
Last modified: Nov 2, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-551986.5Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper vali CVE-2025-551996.5Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which c CVE-2025-55205.3A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmm_state_authentication/e CVE-2025-552005.4BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a Stored Cross-Site Scri CVE-2025-552018.5Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files bec CVE-2025-552025.3Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions befo CVE-2025-552035.4Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting (XSS) vulnerability exists in the d CVE-2025-552049.6muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerab CVE-2025-552059.0Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earli CVE-2025-552075.5Astro is a web framework for content-driven websites. Following CVE-2025-54793 there's still an Open Redirect vulnerability in a subset of A CVE-2025-552089.0Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in `Social Networks`. Thr CVE-2025-552095.1contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions 15.0.14 and belo