CVE-2026-33123: 
Python vulnerability analysis and mitigation

CVE-2026-33123 is a denial-of-service vulnerability in pypdf, a free and open-source pure-Python PDF library, caused by inefficient decoding of array-based streams. An attacker can craft a malicious PDF file that triggers excessive CPU runtime and/or large memory consumption when processed by the library. All versions prior to 6.9.1 are affected; the issue was fixed in pypdf 6.9.1, released on March 17, 2026. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 5.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an inefficient algorithm used when decoding array-based content streams in PDF files, classified under CWE-400 (Uncontrolled Resource Consumption), CWE-407 (Inefficient Algorithmic Complexity), and CWE-770 (Allocation of Resources Without Limits or Throttling). When pypdf processes a PDF containing an array-based stream with a large number of entries, the decoding logic exhibits worst-case computational complexity, consuming disproportionate CPU time and memory without enforcing any upper bound on resource usage. Exploitation requires that the target application open or process an attacker-supplied PDF file. The fix, implemented in PR #3686, improves performance and enforces a length limit on array-based content streams (GitHub Advisory, pypdf PR #3686).

Successful exploitation causes a denial-of-service condition on any system or service that processes attacker-supplied PDF files using a vulnerable version of pypdf. The impact is limited to availability — there is no confidentiality or integrity impact — but affected applications may hang, become unresponsive, or crash due to excessive memory or CPU consumption. Downstream products that embed pypdf, such as IBM watsonx Orchestrate with watsonx Assistant Cartridge, are also affected (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.013–0.014% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a user or automated process must open a crafted PDF with a vulnerable pypdf installation (GitHub Advisory).

1. Craft a malicious PDF: Create a PDF file containing an array-based content stream with an extremely large number of entries, designed to trigger worst-case algorithmic complexity in pypdf's stream decoder.
2. Deliver the PDF: Distribute the crafted PDF to a target that uses a vulnerable version of pypdf (< 6.9.1) — for example, via email attachment, file upload to a web application, or a document processing pipeline.
3. Trigger processing: Cause the target application to open or parse the malicious PDF using pypdf, such as by uploading it to a PDF processing service or convincing a user to open it with an application backed by pypdf.
4. Achieve denial of service: The vulnerable decoding logic consumes excessive CPU and/or memory, causing the application to hang, slow down significantly, or crash, resulting in a denial-of-service condition (GitHub Advisory, pypdf PR #3686).

• Process Behavior: Python processes consuming abnormally high CPU or memory when processing PDF files; processes that hang or become unresponsive during PDF parsing.
• Logs: Application logs showing timeouts, out-of-memory errors, or unhandled exceptions originating from pypdf's stream decoding functions when processing specific PDF files.
• File System: Presence of suspicious PDF files with unusually large or deeply nested array-based content streams submitted to PDF processing endpoints or directories.

The primary remediation is to upgrade pypdf to version 6.9.1 or later, which improves performance and enforces length limits on array-based content streams (pypdf Release 6.9.1). For environments that cannot immediately upgrade, the maintainers recommend manually applying the changes from PR #3686 as a temporary workaround (GitHub Advisory). IBM has also issued guidance for affected watsonx Orchestrate products (IBM Advisory). Additionally, organizations should consider restricting the sources of PDF files accepted for processing and implementing resource limits (e.g., timeouts, memory caps) on PDF processing jobs as a defense-in-depth measure.

The vulnerability was reported by researcher kule500 and analyzed by pypdf maintainer stefan6419846, who published the advisory and patch on the same day (March 17, 2026) (GitHub Advisory). Red Hat tracked the issue via Bugzilla and OpenSUSE issued a security announcement for affected packages (Red Hat Bugzilla). IBM subsequently published an advisory covering the impact on watsonx Orchestrate products (IBM Advisory). No significant social media controversy or broad community debate has been observed around this vulnerability.