Cyber Resilience

CVE-2026-28804

DoS in Pypdf Project Pypdf ≤ 6.7.5

Published
06 March 2026
Modified
10 March 2026
Patch / advisory
CVSS Score v4 6.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0040 33th percentile
Risk Priority 41 floored blend · peak EPSS

Summary

CVE-2026-28804 is a medium-severity Inefficient Algorithmic Complexity (CWE-407) vulnerability in Pypdf Project Pypdf. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue…

more

has been patched in version 6.7.5.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-49460Same product: Pypdf Project Pypdf
CVE-2023-36810Same product: Pypdf Project Pypdf
CVE-2026-41313Same product: Pypdf Project Pypdf
CVE-2025-62707Same product: Pypdf Project Pypdf
CVE-2026-41168Same product: Pypdf Project Pypdf
CVE-2026-41312Same product: Pypdf Project Pypdf
CVE-2026-40260Same product: Pypdf Project Pypdf
CVE-2026-41314Same product: Pypdf Project Pypdf
CVE-2026-59938Same product: Pypdf Project Pypdf
CVE-2025-62708Same product: Pypdf Project Pypdf

Affected Assets

pypdf project
pypdf
≤ 6.7.5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.2.9

Mitigating Controls (NIST 800-53 r5) AI

Denial-of-service protection directly reduces the impact of resource exhaustion triggered by worst-case algorithmic inputs.

Resource availability allocation limits blast radius when an inefficient algorithm is forced into its worst case.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (code review, complexity analysis, safe algorithm selection) prevent introduction of exploitable worst-case behavior.

DE.CM-09 partial match
prevents

Runtime monitoring of software and resources can detect the performance impact of triggered worst-case complexity.

ID.RA-01 partial match
prevents

Identifying and recording algorithmic-complexity vulnerabilities directly addresses the root cause before exploitation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can uncover performance issues stemming from algorithmic complexity.

mitigates

Redundancy of processing facilities can absorb resource exhaustion from inefficient algorithms.

finds

Monitoring activities can identify anomalous resource consumption indicative of algorithmic complexity attacks.

prevents

Secure development life cycle includes design reviews that can catch inefficient algorithms before deployment.

prevents

Secure system architecture principles encourage selection of algorithms with acceptable worst-case complexity.

prevents

Secure coding practices can include guidelines to avoid or mitigate inefficient algorithms.

References