Bug 2388450 (CVE-2025-55197)

Summary:	CVE-2025-55197 pypdf: PyPDF RAM Exhaustion Vulnerability
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anpicker, bparees, haoli, hasun, hkataria, jajackso, jcammara, jfula, jmitchel, jneedle, jowilson, jwong, kegrant, koliveir, kshier, mabashia, nyancey, ometelka, pbraun, ptisnovs, shvarugh, simaishi, smcdonal, stcannon, syedriko, teagle, tfister, thavo, ttakamiy, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in pypdf. Processing maliciously crafted PDF files utilizing a sequence of FlateDecode filters can exhaust available RAM. An attacker can trigger this condition by simply reading the malicious PDF file. This results in a resource exhaustion condition, leading to an application level denial of service. This vulnerability stems from insufficient resource constraints during the decompression process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-08-14 00:01:11 UTC

pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. This issue has been fixed in 6.0.0. If an update is not possible, a workaround involves including the fixed code from pypdf.filters.decompress into the existing filters file.