pypdf, a pure‑Python PDF library, contains a flaw that allows an attacker to craft a PDF with a malformed /FlateDecode stream. When pypdf processes such a stream it performs byte‑by‑byte decompression, leading to arbitrarily long runtimes and potentially exhausting CPU resources. This resource exhaustion vulnerability is reflected in CWE‑1050 and CWE‑770 and can cause an application using pypdf to become unresponsive or crash.

The affected product is the pypdf library distributed under the py‑pdf:pypdf identifier. All releases prior to version 6.7.1 are vulnerable. Applications that import or otherwise invoke pypdf before the 6.7.1 release are susceptible.

The CVSS base score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a malicious PDF to a system that processes PDFs via pypdf. Local or remote execution is possible if the target application accepts untrusted PDF input. Mitigating controls such as fixing the library version or enforcing runtime limits can reduce this risk.