{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-28804", "tracking": { "current_release_date": "2026-03-25T18:36:24.002435Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-28804", "initial_release_date": "2026-03-04T02:39:43.736034Z", "revision_history": [ { "date": "2026-03-04T02:39:43.736034Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-03-04T02:39:47.685632Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-04T18:36:29.859313Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (92).| Product Identifiers created (93).| Products created (2).| References created (3).| CWES updated (1)." }, { "date": "2026-03-04T18:36:45.641063Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-06T07:25:01.583556Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-03-06T07:25:08.227578Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-06T07:38:34.582682Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (4).| CWES updated (1)." }, { "date": "2026-03-06T07:39:43.600215Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-03-06T11:35:22.076179Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-03-06T12:28:29.782743Z", "number": "10", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (9).| Product Identifiers created (3).| Product Remediations created (9).| References created (6).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-03-06T12:28:32.173333Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-03-06T14:52:31.819376Z", "number": "12", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-06T16:38:58.792509Z", "number": "13", "summary": "Unknown change." }, { "date": "2026-03-06T22:39:53.978476Z", "number": "14", "summary": "References created (2)." }, { "date": "2026-03-07T00:36:13.421135Z", "number": "15", "summary": "References created (2)." }, { "date": "2026-03-07T00:46:25.552957Z", "number": "16", "summary": "Source created.| CVE status created. (valid)| Products connected (3)." }, { "date": "2026-03-07T00:46:36.183414Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-03-07T06:43:37.655366Z", "number": "18", "summary": "Description created for source." }, { "date": "2026-03-10T21:26:08.595348Z", "number": "19", "summary": "CVSS created.| Products created (1).| Product Identifiers created (1)." }, { "date": "2026-03-10T21:26:10.511963Z", "number": "20", "summary": "NCSC Score updated." }, { "date": "2026-03-20T09:35:59.603363Z", "number": "21", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-25T18:35:19.894228Z", "number": "22", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (138).| References created (6).| CWES updated (1)." }, { "date": "2026-03-25T18:35:38.550839Z", "number": "23", "summary": "NCSC Score updated." } ], "status": "interim", "version": "23" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2524222", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_lightspeed" } } } ], "category": "product_name", "name": "OpenShift Lightspeed" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/3", "product": { "name": "vers:rpm/3", "product_id": "CSAFPID-5198605", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux_ai:3" } } } ], "category": "product_name", "name": "Red Hat Enterprise Linux AI (RHEL AI) 3" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1439279", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_ai" } } } ], "category": "product_name", "name": "Red Hat OpenShift AI (RHOAI)" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5205180" } } ], "category": "product_name", "name": "bootc-cuda-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5205182" } } ], "category": "product_name", "name": "disk-image-cuda-rhel9" } ], "category": "product_family", "name": "Red Hat Enterprise Linux AI (RHEL AI) 3" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5222641" } } ], "category": "product_name", "name": "lightspeed-ocp-rag-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2960939" } } ], "category": "product_name", "name": "lightspeed-rag-tool-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1508255" } } ], "category": "product_name", "name": "lightspeed-service-api-rhel9" } ], "category": "product_family", "name": "OpenShift Lightspeed" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-3112099" } } ], "category": "product_name", "name": "odh-llama-stack-core-rhel9" } ], "category": "product_family", "name": "Red Hat OpenShift AI (RHOAI)" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-3054952" } } ], "category": "product_name", "name": "pypdf" }, { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-3054953" } } ], "category": "product_name", "name": "pypdf2" } ], "category": "product_family", "name": "bookworm" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-3054954" } } ], "category": "product_name", "name": "pypdf2" } ], "category": "product_family", "name": "bullseye" } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/1.0", "product": { "name": "vers:unknown/1.0", "product_id": "CSAFPID-3245041", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1", "product": { "name": "vers:unknown/1.1", "product_id": "CSAFPID-3245042", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10", "product": { "name": "vers:unknown/1.10", "product_id": "CSAFPID-3245043", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.10" } } }, { "category": "product_version_range", "name": "vers:unknown/1.11", "product": { "name": "vers:unknown/1.11", "product_id": "CSAFPID-3245044", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.11" } } }, { "category": "product_version_range", "name": "vers:unknown/1.12", "product": { "name": "vers:unknown/1.12", "product_id": "CSAFPID-3245045", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.12" } } }, { "category": "product_version_range", "name": "vers:unknown/1.13", "product": { "name": "vers:unknown/1.13", "product_id": "CSAFPID-3245046", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.13" } } }, { "category": "product_version_range", "name": "vers:unknown/1.2", "product": { "name": "vers:unknown/1.2", "product_id": "CSAFPID-3245047", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.26.0", "product": { "name": "vers:unknown/1.26.0", "product_id": "CSAFPID-3744549", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.26.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.0", "product": { "name": "vers:unknown/1.27.0", "product_id": "CSAFPID-3744550", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.27.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.1", "product": { "name": "vers:unknown/1.27.1", "product_id": "CSAFPID-3744551", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.27.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.10", "product": { "name": "vers:unknown/1.27.10", "product_id": "CSAFPID-3744552" } }, { "category": "product_version_range", "name": "vers:unknown/1.27.11", "product": { "name": "vers:unknown/1.27.11", "product_id": "CSAFPID-3744553" } }, { "category": "product_version_range", "name": "vers:unknown/1.27.12", "product": { "name": "vers:unknown/1.27.12", "product_id": "CSAFPID-3744554" } }, { "category": "product_version_range", "name": "vers:unknown/1.27.2", "product": { "name": "vers:unknown/1.27.2", "product_id": "CSAFPID-3744555", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.27.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.3", "product": { "name": "vers:unknown/1.27.3", "product_id": "CSAFPID-3744556", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.27.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.4", "product": { "name": "vers:unknown/1.27.4", "product_id": "CSAFPID-3744557", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.27.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.5", "product": { "name": "vers:unknown/1.27.5", "product_id": "CSAFPID-3744558", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.27.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.6", "product": { "name": "vers:unknown/1.27.6", "product_id": "CSAFPID-3744559", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.27.6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.7", "product": { "name": "vers:unknown/1.27.7", "product_id": "CSAFPID-3744560", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.27.7" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.8", "product": { "name": "vers:unknown/1.27.8", "product_id": "CSAFPID-3744561", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@1.27.8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27.9", "product": { "name": "vers:unknown/1.27.9", "product_id": "CSAFPID-3744562" } }, { "category": "product_version_range", "name": "vers:unknown/1.28.0", "product": { "name": "vers:unknown/1.28.0", "product_id": "CSAFPID-3744563" } }, { "category": "product_version_range", "name": "vers:unknown/1.28.1", "product": { "name": "vers:unknown/1.28.1", "product_id": "CSAFPID-3744564" } }, { "category": "product_version_range", "name": "vers:unknown/1.28.2", "product": { "name": "vers:unknown/1.28.2", "product_id": "CSAFPID-3744565" } }, { "category": "product_version_range", "name": "vers:unknown/1.3", "product": { "name": "vers:unknown/1.3", "product_id": "CSAFPID-3245048", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.4", "product": { "name": "vers:unknown/1.4", "product_id": "CSAFPID-3245049", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.5", "product": { "name": "vers:unknown/1.5", "product_id": "CSAFPID-3245050", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6", "product": { "name": "vers:unknown/1.6", "product_id": "CSAFPID-3245051", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.7", "product": { "name": "vers:unknown/1.7", "product_id": "CSAFPID-3245052", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.7" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8", "product": { "name": "vers:unknown/1.8", "product_id": "CSAFPID-3245053", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9", "product": { "name": "vers:unknown/1.9", "product_id": "CSAFPID-3245054", "product_identification_helper": { "purl": "pkg:pypi/pypdf@1.9" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.0", "product": { "name": "vers:unknown/2.0.0", "product_id": "CSAFPID-3744566" } }, { "category": "product_version_range", "name": "vers:unknown/2.1.0", "product": { "name": "vers:unknown/2.1.0", "product_id": "CSAFPID-3744567" } }, { "category": "product_version_range", "name": "vers:unknown/2.1.1", "product": { "name": "vers:unknown/2.1.1", "product_id": "CSAFPID-3744568" } }, { "category": "product_version_range", "name": "vers:unknown/2.10.0", "product": { "name": "vers:unknown/2.10.0", "product_id": "CSAFPID-3744569", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.10.1", "product": { "name": "vers:unknown/2.10.1", "product_id": "CSAFPID-3744570", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.10.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.10.2", "product": { "name": "vers:unknown/2.10.2", "product_id": "CSAFPID-3744571", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.10.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.10.3", "product": { "name": "vers:unknown/2.10.3", "product_id": "CSAFPID-3744572", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.10.3" } } }, { "category": "product_version_range", "name": "vers:unknown/2.10.4", "product": { "name": "vers:unknown/2.10.4", "product_id": "CSAFPID-3744573", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.10.4" } } }, { "category": "product_version_range", "name": "vers:unknown/2.10.5", "product": { "name": "vers:unknown/2.10.5", "product_id": "CSAFPID-966227", "product_identification_helper": { "cpe": "cpe:2.3:a:py-pdf:pypdf:2.10.5:*:*:*:*:*:*:*", "purl": "pkg:pypi/pypdf2@2.10.5" } } }, { "category": "product_version_range", "name": "vers:unknown/2.10.6", "product": { "name": "vers:unknown/2.10.6", "product_id": "CSAFPID-3744574", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.10.6" } } }, { "category": "product_version_range", "name": "vers:unknown/2.10.7", "product": { "name": "vers:unknown/2.10.7", "product_id": "CSAFPID-3744575", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.10.7" } } }, { "category": "product_version_range", "name": "vers:unknown/2.10.8", "product": { "name": "vers:unknown/2.10.8", "product_id": "CSAFPID-3744576", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.10.8" } } }, { "category": "product_version_range", "name": "vers:unknown/2.10.9", "product": { "name": "vers:unknown/2.10.9", "product_id": "CSAFPID-3744577", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.10.9" } } }, { "category": "product_version_range", "name": "vers:unknown/2.11.0", "product": { "name": "vers:unknown/2.11.0", "product_id": "CSAFPID-3744578", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.11.1", "product": { "name": "vers:unknown/2.11.1", "product_id": "CSAFPID-3744579", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.11.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.11.2", "product": { "name": "vers:unknown/2.11.2", "product_id": "CSAFPID-3744580", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.11.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.12.0", "product": { "name": "vers:unknown/2.12.0", "product_id": "CSAFPID-3744581", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.12.1", "product": { "name": "vers:unknown/2.12.1", "product_id": "CSAFPID-3744582", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.12.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.2.0", "product": { "name": "vers:unknown/2.2.0", "product_id": "CSAFPID-3744583", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.2.1", "product": { "name": "vers:unknown/2.2.1", "product_id": "CSAFPID-3744584", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.3.0", "product": { "name": "vers:unknown/2.3.0", "product_id": "CSAFPID-3744585", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.3.1", "product": { "name": "vers:unknown/2.3.1", "product_id": "CSAFPID-3744586", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.4.0", "product": { "name": "vers:unknown/2.4.0", "product_id": "CSAFPID-3744587", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.4.1", "product": { "name": "vers:unknown/2.4.1", "product_id": "CSAFPID-3744588", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.4.2", "product": { "name": "vers:unknown/2.4.2", "product_id": "CSAFPID-3744589", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.4.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.5.0", "product": { "name": "vers:unknown/2.5.0", "product_id": "CSAFPID-3744590", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.6.0", "product": { "name": "vers:unknown/2.6.0", "product_id": "CSAFPID-3744591", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.7.0", "product": { "name": "vers:unknown/2.7.0", "product_id": "CSAFPID-3744592", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.8.0", "product": { "name": "vers:unknown/2.8.0", "product_id": "CSAFPID-3744593", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.8.1", "product": { "name": "vers:unknown/2.8.1", "product_id": "CSAFPID-3744594", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.9.0", "product": { "name": "vers:unknown/2.9.0", "product_id": "CSAFPID-3744595", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@2.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0", "product": { "name": "vers:unknown/3.0.0", "product_id": "CSAFPID-3744596", "product_identification_helper": { "purl": "pkg:pypi/pypdf2@3.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.0", "product": { "name": "vers:unknown/3.1.0", "product_id": "CSAFPID-3245055", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.10.0", "product": { "name": "vers:unknown/3.10.0", "product_id": "CSAFPID-3245056", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.11.0", "product": { "name": "vers:unknown/3.11.0", "product_id": "CSAFPID-3245057", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.11.1", "product": { "name": "vers:unknown/3.11.1", "product_id": "CSAFPID-3245058", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.11.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.12.0", "product": { "name": "vers:unknown/3.12.0", "product_id": "CSAFPID-3245059", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.12.1", "product": { "name": "vers:unknown/3.12.1", "product_id": "CSAFPID-3245060", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.12.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.12.2", "product": { "name": "vers:unknown/3.12.2", "product_id": "CSAFPID-3245061", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.12.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.13.0", "product": { "name": "vers:unknown/3.13.0", "product_id": "CSAFPID-3245062", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.13.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.14.0", "product": { "name": "vers:unknown/3.14.0", "product_id": "CSAFPID-3245063", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.14.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.0", "product": { "name": "vers:unknown/3.15.0", "product_id": "CSAFPID-3245064", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.15.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.1", "product": { "name": "vers:unknown/3.15.1", "product_id": "CSAFPID-3245065", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.15.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.2", "product": { "name": "vers:unknown/3.15.2", "product_id": "CSAFPID-3245066", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.15.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.3", "product": { "name": "vers:unknown/3.15.3", "product_id": "CSAFPID-3245067", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.15.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.4", "product": { "name": "vers:unknown/3.15.4", "product_id": "CSAFPID-3245068", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.15.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.5", "product": { "name": "vers:unknown/3.15.5", "product_id": "CSAFPID-3245069", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.15.5" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.0", "product": { "name": "vers:unknown/3.16.0", "product_id": "CSAFPID-3245070", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.16.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.1", "product": { "name": "vers:unknown/3.16.1", "product_id": "CSAFPID-3245071", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.16.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.2", "product": { "name": "vers:unknown/3.16.2", "product_id": "CSAFPID-3245072", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.16.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.3", "product": { "name": "vers:unknown/3.16.3", "product_id": "CSAFPID-3245073", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.16.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.4", "product": { "name": "vers:unknown/3.16.4", "product_id": "CSAFPID-3245074", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.16.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.17.0", "product": { "name": "vers:unknown/3.17.0", "product_id": "CSAFPID-3245075", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.17.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.17.1", "product": { "name": "vers:unknown/3.17.1", "product_id": "CSAFPID-3245076", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.17.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.17.2", "product": { "name": "vers:unknown/3.17.2", "product_id": "CSAFPID-3245077", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.17.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.17.3", "product": { "name": "vers:unknown/3.17.3", "product_id": "CSAFPID-3245078", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.17.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.17.4", "product": { "name": "vers:unknown/3.17.4", "product_id": "CSAFPID-3245079", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.17.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.2.0", "product": { "name": "vers:unknown/3.2.0", "product_id": "CSAFPID-3245080", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.2.1", "product": { "name": "vers:unknown/3.2.1", "product_id": "CSAFPID-3245081", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.3.0", "product": { "name": "vers:unknown/3.3.0", "product_id": "CSAFPID-3245082", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.4.0", "product": { "name": "vers:unknown/3.4.0", "product_id": "CSAFPID-3245083", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.4.1", "product": { "name": "vers:unknown/3.4.1", "product_id": "CSAFPID-3245084", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.5.0", "product": { "name": "vers:unknown/3.5.0", "product_id": "CSAFPID-3245085", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.5.1", "product": { "name": "vers:unknown/3.5.1", "product_id": "CSAFPID-3245086", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.5.2", "product": { "name": "vers:unknown/3.5.2", "product_id": "CSAFPID-3245087", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.5.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.6.0", "product": { "name": "vers:unknown/3.6.0", "product_id": "CSAFPID-3245088", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.7.0", "product": { "name": "vers:unknown/3.7.0", "product_id": "CSAFPID-3245089", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.7.1", "product": { "name": "vers:unknown/3.7.1", "product_id": "CSAFPID-3245090", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.8.0", "product": { "name": "vers:unknown/3.8.0", "product_id": "CSAFPID-3245091", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.8.1", "product": { "name": "vers:unknown/3.8.1", "product_id": "CSAFPID-3245092", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.9.0", "product": { "name": "vers:unknown/3.9.0", "product_id": "CSAFPID-3245093", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.9.1", "product": { "name": "vers:unknown/3.9.1", "product_id": "CSAFPID-3245094", "product_identification_helper": { "purl": "pkg:pypi/pypdf@3.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0", "product": { "name": "vers:unknown/4.0.0", "product_id": "CSAFPID-3245095", "product_identification_helper": { "purl": "pkg:pypi/pypdf@4.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.0.1", "product": { "name": "vers:unknown/4.0.1", "product_id": "CSAFPID-3245096", "product_identification_helper": { "purl": "pkg:pypi/pypdf@4.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/4.0.2", "product": { "name": "vers:unknown/4.0.2", "product_id": "CSAFPID-3245097", "product_identification_helper": { "purl": "pkg:pypi/pypdf@4.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/4.1.0", "product": { "name": "vers:unknown/4.1.0", "product_id": "CSAFPID-3245098", "product_identification_helper": { "purl": "pkg:pypi/pypdf@4.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.2.0", "product": { "name": "vers:unknown/4.2.0", "product_id": "CSAFPID-3245099", "product_identification_helper": { "purl": "pkg:pypi/pypdf@4.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.0", "product": { "name": "vers:unknown/4.3.0", "product_id": "CSAFPID-3245100", "product_identification_helper": { "purl": "pkg:pypi/pypdf@4.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.1", "product": { "name": "vers:unknown/4.3.1", "product_id": "CSAFPID-3245101", "product_identification_helper": { "purl": "pkg:pypi/pypdf@4.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.0.0", "product": { "name": "vers:unknown/5.0.0", "product_id": "CSAFPID-3245102", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.0.1", "product": { "name": "vers:unknown/5.0.1", "product_id": "CSAFPID-3245103", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.1.0", "product": { "name": "vers:unknown/5.1.0", "product_id": "CSAFPID-3245104", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.2.0", "product": { "name": "vers:unknown/5.2.0", "product_id": "CSAFPID-3245105", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.3.0", "product": { "name": "vers:unknown/5.3.0", "product_id": "CSAFPID-3245106", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.3.1", "product": { "name": "vers:unknown/5.3.1", "product_id": "CSAFPID-3245107", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.4.0", "product": { "name": "vers:unknown/5.4.0", "product_id": "CSAFPID-3245108", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.5.0", "product": { "name": "vers:unknown/5.5.0", "product_id": "CSAFPID-3245109", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.6.0", "product": { "name": "vers:unknown/5.6.0", "product_id": "CSAFPID-3245110", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.6.1", "product": { "name": "vers:unknown/5.6.1", "product_id": "CSAFPID-3245111", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.7.0", "product": { "name": "vers:unknown/5.7.0", "product_id": "CSAFPID-3245112", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.8.0", "product": { "name": "vers:unknown/5.8.0", "product_id": "CSAFPID-3245113", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.9.0", "product": { "name": "vers:unknown/5.9.0", "product_id": "CSAFPID-3245114", "product_identification_helper": { "purl": "pkg:pypi/pypdf@5.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.0.0", "product": { "name": "vers:unknown/6.0.0", "product_id": "CSAFPID-5132945", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.1.0", "product": { "name": "vers:unknown/6.1.0", "product_id": "CSAFPID-5132946", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.1.1", "product": { "name": "vers:unknown/6.1.1", "product_id": "CSAFPID-5132947", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/6.1.2", "product": { "name": "vers:unknown/6.1.2", "product_id": "CSAFPID-5132948", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/6.1.3", "product": { "name": "vers:unknown/6.1.3", "product_id": "CSAFPID-5208313", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/6.2.0", "product": { "name": "vers:unknown/6.2.0", "product_id": "CSAFPID-5208314", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.3.0", "product": { "name": "vers:unknown/6.3.0", "product_id": "CSAFPID-5208315", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.4.0", "product": { "name": "vers:unknown/6.4.0", "product_id": "CSAFPID-5365058", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.4.1", "product": { "name": "vers:unknown/6.4.1", "product_id": "CSAFPID-5365059", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/6.4.2", "product": { "name": "vers:unknown/6.4.2", "product_id": "CSAFPID-5365060", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.4.2" } } }, { "category": "product_version_range", "name": "vers:unknown/6.5.0", "product": { "name": "vers:unknown/6.5.0", "product_id": "CSAFPID-5365061", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.6.0", "product": { "name": "vers:unknown/6.6.0", "product_id": "CSAFPID-5466673", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.6.1", "product": { "name": "vers:unknown/6.6.1", "product_id": "CSAFPID-5466674", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/6.6.2", "product": { "name": "vers:unknown/6.6.2", "product_id": "CSAFPID-5659521", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.6.2" } } }, { "category": "product_version_range", "name": "vers:unknown/6.7.0", "product": { "name": "vers:unknown/6.7.0", "product_id": "CSAFPID-5657723", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.7.1", "product": { "name": "vers:unknown/6.7.1", "product_id": "CSAFPID-5701485", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/6.7.2", "product": { "name": "vers:unknown/6.7.2", "product_id": "CSAFPID-5726071", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.7.2" } } }, { "category": "product_version_range", "name": "vers:unknown/6.7.3", "product": { "name": "vers:unknown/6.7.3", "product_id": "CSAFPID-5748971", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.7.3" } } }, { "category": "product_version_range", "name": "vers:unknown/6.7.4", "product": { "name": "vers:unknown/6.7.4", "product_id": "CSAFPID-5759178", "product_identification_helper": { "purl": "pkg:pypi/pypdf@6.7.4" } } }, { "category": "product_version_range", "name": "vers:unknown/<6.7.5", "product": { "name": "vers:unknown/<6.7.5", "product_id": "CSAFPID-5765476" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<6.7.5", "product": { "name": "vers:unknown/>=0|<6.7.5", "product_id": "CSAFPID-5759179" } }, { "category": "product_version_range", "name": "vers:unknown/v1.17", "product": { "name": "vers:unknown/v1.17", "product_id": "CSAFPID-3744597" } }, { "category": "product_version_range", "name": "vers:unknown/v1.18", "product": { "name": "vers:unknown/v1.18", "product_id": "CSAFPID-3744598" } }, { "category": "product_version_range", "name": "vers:unknown/v1.19", "product": { "name": "vers:unknown/v1.19", "product_id": "CSAFPID-3744599" } }, { "category": "product_version_range", "name": "vers:unknown/v1.20", "product": { "name": "vers:unknown/v1.20", "product_id": "CSAFPID-3744600" } }, { "category": "product_version_range", "name": "vers:unknown/v1.21", "product": { "name": "vers:unknown/v1.21", "product_id": "CSAFPID-3744601" } }, { "category": "product_version_range", "name": "vers:unknown/v1.22", "product": { "name": "vers:unknown/v1.22", "product_id": "CSAFPID-3744602" } }, { "category": "product_version_range", "name": "vers:unknown/v1.23", "product": { "name": "vers:unknown/v1.23", "product_id": "CSAFPID-3744603" } }, { "category": "product_version_range", "name": "vers:unknown/v1.24", "product": { "name": "vers:unknown/v1.24", "product_id": "CSAFPID-3744604" } }, { "category": "product_version_range", "name": "vers:unknown/v1.25", "product": { "name": "vers:unknown/v1.25", "product_id": "CSAFPID-3744605" } }, { "category": "product_version_range", "name": "vers:unknown/v1.25.1", "product": { "name": "vers:unknown/v1.25.1", "product_id": "CSAFPID-3744606" } } ], "category": "product_name", "name": "pypdf" } ], "category": "vendor", "name": "py-pdf" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<6.7.5", "product": { "name": "vers:unknown/<6.7.5", "product_id": "CSAFPID-5778682", "product_identification_helper": { "cpe": "cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "pypdf" } ], "category": "vendor", "name": "pypdf_project" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-28804", "cwe": { "id": "CWE-407", "name": "Inefficient Algorithmic Complexity" }, "notes": [ { "category": "description", "text": "### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/ASCIIHexDecode` filter.\n\n### Patches\nThis has been fixed in [pypdf==6.7.5](https://github.com/py-pdf/pypdf/releases/tag/6.7.5).\n\n### Workarounds\nIf you cannot upgrade yet, consider applying the changes from PR [#3666](https://github.com/py-pdf/pypdf/pull/3666).", "title": "github - https://github.com/advisories/GHSA-9m86-7pmv-2852" }, { "category": "description", "text": "### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/ASCIIHexDecode` filter.\n\n### Patches\nThis has been fixed in [pypdf==6.7.5](https://github.com/py-pdf/pypdf/releases/tag/6.7.5).\n\n### Workarounds\nIf you cannot upgrade yet, consider applying the changes from PR [#3666](https://github.com/py-pdf/pypdf/pull/3666).", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-9m86-7pmv-2852.json?alt=media" }, { "category": "description", "text": "pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-28804" }, { "category": "description", "text": "pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-28804" }, { "category": "description", "text": "No description is available for this CVE.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-28804" }, { "category": "description", "text": "pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-28804" }, { "category": "description", "text": "pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-28804.json?alt=media" }, { "category": "other", "text": "0.00045", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" }, { "category": "other", "text": "6.9", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.7", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Redhat", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 2\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-3245041", "CSAFPID-3245042", "CSAFPID-3245043", "CSAFPID-3245044", "CSAFPID-3245045", "CSAFPID-3245046", "CSAFPID-3245047", "CSAFPID-3245048", "CSAFPID-3245049", "CSAFPID-3245050", "CSAFPID-3245051", "CSAFPID-3245052", "CSAFPID-3245053", "CSAFPID-3245054", "CSAFPID-3245055", "CSAFPID-3245056", "CSAFPID-3245057", "CSAFPID-3245058", "CSAFPID-3245059", "CSAFPID-3245060", "CSAFPID-3245061", "CSAFPID-3245062", "CSAFPID-3245063", "CSAFPID-3245064", "CSAFPID-3245065", "CSAFPID-3245066", "CSAFPID-3245067", "CSAFPID-3245068", "CSAFPID-3245069", "CSAFPID-3245070", "CSAFPID-3245071", "CSAFPID-3245072", "CSAFPID-3245073", "CSAFPID-3245074", "CSAFPID-3245075", "CSAFPID-3245076", "CSAFPID-3245077", "CSAFPID-3245078", "CSAFPID-3245079", "CSAFPID-3245080", "CSAFPID-3245081", "CSAFPID-3245082", "CSAFPID-3245083", "CSAFPID-3245084", "CSAFPID-3245085", "CSAFPID-3245086", "CSAFPID-3245087", "CSAFPID-3245088", "CSAFPID-3245089", "CSAFPID-3245090", "CSAFPID-3245091", "CSAFPID-3245092", "CSAFPID-3245093", "CSAFPID-3245094", "CSAFPID-3245095", "CSAFPID-3245096", "CSAFPID-3245097", "CSAFPID-3245098", "CSAFPID-3245099", "CSAFPID-3245100", "CSAFPID-3245101", "CSAFPID-3245102", "CSAFPID-3245103", "CSAFPID-3245104", "CSAFPID-3245105", "CSAFPID-3245106", "CSAFPID-3245107", "CSAFPID-3245108", "CSAFPID-3245109", "CSAFPID-3245110", "CSAFPID-3245111", "CSAFPID-3245112", "CSAFPID-3245113", "CSAFPID-3245114", "CSAFPID-5132945", "CSAFPID-5132946", "CSAFPID-5132947", "CSAFPID-5132948", "CSAFPID-5208313", "CSAFPID-5208314", "CSAFPID-5208315", "CSAFPID-5365058", "CSAFPID-5365059", "CSAFPID-5365060", "CSAFPID-5365061", "CSAFPID-5466673", "CSAFPID-5466674", "CSAFPID-5657723", "CSAFPID-5659521", "CSAFPID-5701485", "CSAFPID-5726071", "CSAFPID-5748971", "CSAFPID-5759178", "CSAFPID-5759179", "CSAFPID-5765476", "CSAFPID-1439279", "CSAFPID-1508255", "CSAFPID-2524222", "CSAFPID-2960939", "CSAFPID-3112099", "CSAFPID-5198605", "CSAFPID-5205180", "CSAFPID-5205182", "CSAFPID-5222641", "CSAFPID-3054952", "CSAFPID-3054953", "CSAFPID-3054954", "CSAFPID-5778682", "CSAFPID-966227", "CSAFPID-3744549", "CSAFPID-3744550", "CSAFPID-3744551", "CSAFPID-3744552", "CSAFPID-3744553", "CSAFPID-3744554", "CSAFPID-3744555", "CSAFPID-3744556", "CSAFPID-3744557", "CSAFPID-3744558", "CSAFPID-3744559", "CSAFPID-3744560", "CSAFPID-3744561", "CSAFPID-3744562", "CSAFPID-3744563", "CSAFPID-3744564", "CSAFPID-3744565", "CSAFPID-3744566", "CSAFPID-3744567", "CSAFPID-3744568", "CSAFPID-3744569", "CSAFPID-3744570", "CSAFPID-3744571", "CSAFPID-3744572", "CSAFPID-3744573", "CSAFPID-3744574", "CSAFPID-3744575", "CSAFPID-3744576", "CSAFPID-3744577", "CSAFPID-3744578", "CSAFPID-3744579", "CSAFPID-3744580", "CSAFPID-3744581", "CSAFPID-3744582", "CSAFPID-3744583", "CSAFPID-3744584", "CSAFPID-3744585", "CSAFPID-3744586", "CSAFPID-3744587", "CSAFPID-3744588", "CSAFPID-3744589", "CSAFPID-3744590", "CSAFPID-3744591", "CSAFPID-3744592", "CSAFPID-3744593", "CSAFPID-3744594", "CSAFPID-3744595", "CSAFPID-3744596", "CSAFPID-3744597", "CSAFPID-3744598", "CSAFPID-3744599", "CSAFPID-3744600", "CSAFPID-3744601", "CSAFPID-3744602", "CSAFPID-3744603", "CSAFPID-3744604", "CSAFPID-3744605", "CSAFPID-3744606" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-9m86-7pmv-2852" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-9m86-7pmv-2852" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-9m86-7pmv-2852.json?alt=media" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28804" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-28804" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28804" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/28xxx/CVE-2026-28804.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-28804" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28804.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28804" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-28804" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-28804.json?alt=media" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/py-pdf/pypdf/pull/3666" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/py-pdf/pypdf/releases/tag/6.7.5" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-9m86-7pmv-2852" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28804" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28804" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28804.json" } ], "remediations": [ { "category": "mitigation", "details": "To mitigate this issue, avoid processing untrusted PDF documents with applications that use the pypdf library. If processing untrusted PDFs is unavoidable, consider sandboxing the application responsible for PDF processing to limit potential resource exhaustion.", "product_ids": [ "CSAFPID-1439279", "CSAFPID-1508255", "CSAFPID-2524222", "CSAFPID-2960939", "CSAFPID-3112099", "CSAFPID-5198605", "CSAFPID-5205180", "CSAFPID-5205182", "CSAFPID-5222641" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1439279", "CSAFPID-1508255", "CSAFPID-2524222", "CSAFPID-2960939", "CSAFPID-3054952", "CSAFPID-3054953", "CSAFPID-3054954", "CSAFPID-3112099", "CSAFPID-3245041", "CSAFPID-3245042", "CSAFPID-3245043", "CSAFPID-3245044", "CSAFPID-3245045", "CSAFPID-3245046", "CSAFPID-3245047", "CSAFPID-3245048", "CSAFPID-3245049", "CSAFPID-3245050", "CSAFPID-3245051", "CSAFPID-3245052", "CSAFPID-3245053", "CSAFPID-3245054", "CSAFPID-3245055", "CSAFPID-3245056", "CSAFPID-3245057", "CSAFPID-3245058", "CSAFPID-3245059", "CSAFPID-3245060", "CSAFPID-3245061", "CSAFPID-3245062", "CSAFPID-3245063", "CSAFPID-3245064", "CSAFPID-3245065", "CSAFPID-3245066", "CSAFPID-3245067", "CSAFPID-3245068", "CSAFPID-3245069", "CSAFPID-3245070", "CSAFPID-3245071", "CSAFPID-3245072", "CSAFPID-3245073", "CSAFPID-3245074", "CSAFPID-3245075", "CSAFPID-3245076", "CSAFPID-3245077", "CSAFPID-3245078", "CSAFPID-3245079", "CSAFPID-3245080", "CSAFPID-3245081", "CSAFPID-3245082", "CSAFPID-3245083", "CSAFPID-3245084", "CSAFPID-3245085", "CSAFPID-3245086", "CSAFPID-3245087", "CSAFPID-3245088", "CSAFPID-3245089", "CSAFPID-3245090", "CSAFPID-3245091", "CSAFPID-3245092", "CSAFPID-3245093", "CSAFPID-3245094", "CSAFPID-3245095", "CSAFPID-3245096", "CSAFPID-3245097", "CSAFPID-3245098", "CSAFPID-3245099", "CSAFPID-3245100", "CSAFPID-3245101", "CSAFPID-3245102", "CSAFPID-3245103", "CSAFPID-3245104", "CSAFPID-3245105", "CSAFPID-3245106", "CSAFPID-3245107", "CSAFPID-3245108", "CSAFPID-3245109", "CSAFPID-3245110", "CSAFPID-3245111", "CSAFPID-3245112", "CSAFPID-3245113", "CSAFPID-3245114", "CSAFPID-3744549", "CSAFPID-3744550", "CSAFPID-3744551", "CSAFPID-3744552", "CSAFPID-3744553", "CSAFPID-3744554", "CSAFPID-3744555", "CSAFPID-3744556", "CSAFPID-3744557", "CSAFPID-3744558", "CSAFPID-3744559", "CSAFPID-3744560", "CSAFPID-3744561", "CSAFPID-3744562", "CSAFPID-3744563", "CSAFPID-3744564", "CSAFPID-3744565", "CSAFPID-3744566", "CSAFPID-3744567", "CSAFPID-3744568", "CSAFPID-3744569", "CSAFPID-3744570", "CSAFPID-3744571", "CSAFPID-3744572", "CSAFPID-3744573", "CSAFPID-3744574", "CSAFPID-3744575", "CSAFPID-3744576", "CSAFPID-3744577", "CSAFPID-3744578", "CSAFPID-3744579", "CSAFPID-3744580", "CSAFPID-3744581", "CSAFPID-3744582", "CSAFPID-3744583", "CSAFPID-3744584", "CSAFPID-3744585", "CSAFPID-3744586", "CSAFPID-3744587", "CSAFPID-3744588", "CSAFPID-3744589", "CSAFPID-3744590", "CSAFPID-3744591", "CSAFPID-3744592", "CSAFPID-3744593", "CSAFPID-3744594", "CSAFPID-3744595", "CSAFPID-3744596", "CSAFPID-3744597", "CSAFPID-3744598", "CSAFPID-3744599", "CSAFPID-3744600", "CSAFPID-3744601", "CSAFPID-3744602", "CSAFPID-3744603", "CSAFPID-3744604", "CSAFPID-3744605", "CSAFPID-3744606", "CSAFPID-5132945", "CSAFPID-5132946", "CSAFPID-5132947", "CSAFPID-5132948", "CSAFPID-5198605", "CSAFPID-5205180", "CSAFPID-5205182", "CSAFPID-5208313", "CSAFPID-5208314", "CSAFPID-5208315", "CSAFPID-5222641", "CSAFPID-5365058", "CSAFPID-5365059", "CSAFPID-5365060", "CSAFPID-5365061", "CSAFPID-5466673", "CSAFPID-5466674", "CSAFPID-5657723", "CSAFPID-5659521", "CSAFPID-5701485", "CSAFPID-5726071", "CSAFPID-5748971", "CSAFPID-5759178", "CSAFPID-5759179", "CSAFPID-5765476", "CSAFPID-5778682", "CSAFPID-966227" ] } ], "title": "CVE-2026-28804" } ] }