pypdf Memory Exhaustion Vulnerability Due to Improper Stream Length Handling

A memory exhaustion vulnerability has been identified in pypdf, a pure-Python PDF library, affecting versions prior to 6.8.0. The issue arises when the library parses a content stream with a large '/Length' value, leading to excessive memory usage. This vulnerability can be exploited by crafting a PDF that takes advantage of the improper handling of stream length values.

Impact

Exploitation of this vulnerability can lead to significant memory consumption, potentially causing applications to run out of available RAM.

Remediation

Users can upgrade to pypdf version 6.8.0 or later to address this vulnerability. If an immediate upgrade is not possible, consider applying the changes from Pull Request #3675, which are available in the 6.8.0 release.