PyPI: pypdf
CVE-2025-66019
Safety vulnerability ID: SFTY-20251124-08236
Safety legacy ID: pyup.io-81877
Affected versions of the pypdf package are vulnerable to Denial of Service (DoS) due to insufficient limiting of memory usage when decoding LZWDecode content streams. The pypdf.filters LZWDecode implementation allows attacker-controlled page content streams to be decompressed without an effective maximum output size, so a single highly compressed stream can expand to roughly 1 GB of in-memory data during parsing.
Overview
pypdf's LZWDecode streams be manipulated to exhaust RAM
Advisory
Affected versions of the pypdf package are vulnerable to Denial of Service (DoS) due to insufficient limiting of memory usage when decoding LZWDecode content streams. The pypdf.filters LZWDecode implementation allows attacker-controlled page content streams to be decompressed without an effective maximum output size, so a single highly compressed stream can expand to roughly 1 GB of in-memory data during parsing.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20251124-08236/CVE-2025-66019
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j
- https://github.com/py-pdf/pypdf/security/advisories/GHSA-m449-cwjh-6pw7
- https://github.com/py-pdf/pypdf/commit/96186725e5e6f237129a58a97cd19204a9ce40b2
- https://github.com/py-pdf/pypdf/releases/tag/6.4.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-66019
- https://aydinnyunus.github.io/2025/12/20/cve-2025-66019-pypdf-lzw-dos
- https://github.com/advisories/GHSA-m449-cwjh-6pw7
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more