{"vulnerability": "cve-2026-7187", "sightings": [{"uuid": "6c16d556-2a08-40e2-8bab-5f04cdac0dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71870", "type": "seen", "source": "https://gist.github.com/alon710/51a19d7e4b20307e86a86a2096f8e2e7", "content": "# CVE-2026-71870: CVE-2026-71870: Uncontrolled Resource Consumption (DoS) in pypdf ToUnicode CMap Parsing\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71870\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400) exists in pypdf prior to version 6.15.0. When extracting text from a specially crafted PDF document, the parser fails to restrict token lengths within /ToUnicode CMap streams, causing unbounded memory allocation and process termination via Out-of-Memory (OOM) crashes.\n\n## TL;DR\nA vulnerability in pypdf allows attackers to trigger a Denial of Service (OOM crash) via crafted /ToUnicode CMap streams containing massive hex-encoded tokens.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Local (via crafted document parsing)\n- **CVSS Score**: 4.8\n- **Impact**: Denial of Service (OOM Process Crash)\n- **Exploit Status**: Proof-of-Concept only\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- pypdf library deployments processing untrusted PDF documents\n- **pypdf**: < 6.15.0 (Fixed in: `6.15.0`)\n\n## Mitigation\n\n- Upgrade the pypdf dependency to version 6.15.0 or later to ensure validation of CMap token sizes\n- Isolate PDF processing workers in containerized environments with strict memory limits using cgroups\n- Validate incoming file sizes and strip excessive stream data prior to extraction processing\n\n**Remediation Steps:**\n1. Identify all deployment environments running the pypdf library\n2. Run 'pip install --upgrade pypdf>=6.15.0' or update the project requirements.txt/poetry.lock file\n3. Verify text extraction processes handle 'LimitReachedError' exceptions gracefully to prevent unhandled service crashes\n4. Configure container resources with memory limits to prevent host-level OOM events\n\n## References\n\n- [GHSA Security Advisory](https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c)\n- [Pull Request #3944](https://github.com/py-pdf/pypdf/pull/3944)\n- [Fix Commit](https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa)\n- [Release Information](https://github.com/py-pdf/pypdf/releases/tag/6.15.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71870) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T20:34:02.124232Z"}, {"uuid": "cb06ebd6-8106-4b73-8374-836f275325ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71878", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtezikaxm22j", "content": "\ud83d\udea8 CVE-2026-71878 \u2014 CVSS 9.2 CRITICAL\n\nMissing authentication in initial setup functionality left exposed after initial setup is completed in GBIF...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-71878\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T20:09:25.944788Z"}, {"uuid": "80e83c2f-73d5-4801-8ac3-d95e7324e439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71879", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtezitcokw2c", "content": "\ud83d\udea8 CVE-2026-71879 \u2014 CVSS 9.1 CRITICAL\n\nMissing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Pu...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-71879\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T20:09:35.495136Z"}, {"uuid": "2ea4ee62-ee21-4906-a410-8f8fc14deff2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71871", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtocsleu2e2u", "content": "CVE-2026-71871\nIf you use Orval to generate client code and include a header default that contains a back\u2011tick or ${...} expression, the generated file can run malicious JavaScript when it is loaded. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-22T12:50:05.558043Z"}, {"uuid": "d6988cef-a5be-41bb-8cbd-b309d453d7ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71878", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtf4d3ujvs2j", "content": "CVE-2026-71878 - integrated publishing toolkit\nGBIF Integrated Publishing Toolkit versions before 3.3.4 have a security issue where attackers can bypass authentication and gain administrative control. This is a concern\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gbif #CVE #infosec", "creation_timestamp": "2026-08-18T21:00:04.714140Z"}, {"uuid": "d23e74f4-897d-4e65-bda4-d3ff4792213c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71879", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtf4d5jm4w2f", "content": "CVE-2026-71879 - integrated publishing toolkit\nGBIF Integrated Publishing Toolkit versions before 3.3.4 have a security issue that allows attackers to gain full control of the system. This can happen when an attacker is\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gbif #CVE #infosec", "creation_timestamp": "2026-08-18T21:00:06.560802Z"}, {"uuid": "fcadadbf-6bf3-4a7b-9a85-261c04ee4304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71871", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mthk2jekhx2m", "content": "\ud83d\udea8 CVE-2026-71871 \u2014 CVSS 9.3 CRITICAL\n\nOrval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. P...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-71871\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-19T20:11:08.296678Z"}, {"uuid": "4d6f5a04-cef5-46be-a001-50276d2a0f14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71871", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mthyjjhdlf2e", "content": "CVE-2026-71871 - orval\nA security issue in Orval allows attackers to inject malicious JavaScript code. This can happen when generating clients from OpenAPI specifications. Update to version 8.21.0 to fix the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#orval #orvallabs #CVE #infosec", "creation_timestamp": "2026-08-20T00:30:04.254621Z"}, {"uuid": "0dc49d2c-c0a7-4cc2-b461-96da1a6d8681", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7187", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrpopepcn72s", "content": "CVE-2026-7187 - Improper Authentication in Universal Sotware's UKBS\nCVE ID : CVE-2026-7187\n \n Published : July 28, 2026, 1:19 p.m. | 1\u00a0hour, 21\u00a0minutes ago\n \n Description : Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Access...", "creation_timestamp": "2026-07-28T15:05:17.687266Z"}, {"uuid": "b399c513-48c8-499c-ae79-7951a20adf72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7187", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrprt6dsa32c", "content": "\ud83d\udfe0 CVE-2026-7187 - High (8.8)\n\nMissing authentication for critical function vulnerability in Universal Software Inc. UKBS allows...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-7187/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T16:01:07.045120Z"}, {"uuid": "3d4f6460-9ac2-419d-bdd6-d8350735f85c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71871", "type": "published-proof-of-concept", "source": "https://github.com/orval-labs/orval/security/advisories/GHSA-8j6p-r8jg-mxqh", "content": "", "creation_timestamp": "2026-09-03T20:35:24.905435Z"}]}